latchkey 3.10.1 → 3.11.1

package/dist/src/services/core/loginFlows/tokenCapture.js

@@ -1,7 +1,14 @@
 /**
  * A generic browser login for services whose credential is a token the web app
- * mints for itself: open a URL, watch the responses that arrive while the user
- * signs in, and lift a token out of the JSON body of a named endpoint.
+ * mints for itself: open a URL, and lift a token out of the JSON body of a
+ * named endpoint, either as it goes by or by asking for it.
+ *
+ * Watching alone is not enough, because a web app calls its own mint endpoint
+ * when it needs a token and not otherwise. ChatGPT is the case that showed
+ * this: it signs in, renders the app, and never calls `/api/auth/session` —
+ * the endpoint is there and answers with a token, but a login that only
+ * listens waits for a request that is never made. So once the browser reaches
+ * the endpoint's origin, this flow also asks it directly.
  *
  * This is the counterpart to `cookie-capture`, for the other common shape. In a
  * cookie-authenticated service the cookie *is* the API credential, so capturing
@@ -36,6 +43,12 @@ const TOKEN_PLACEHOLDER = '{token}';
  * Bearer is what the great majority of token-minting web APIs expect.
  */
 const DEFAULT_HEADER_TEMPLATE = `Authorization: Bearer ${TOKEN_PLACEHOLDER}`;
+/**
+ * How often the endpoint is asked, once the browser is somewhere it can be
+ * asked from. Slow enough not to hammer a service through a login that takes a
+ * while, quick enough that the login ends promptly once a token exists.
+ */
+const TOKEN_REQUEST_INTERVAL_MS = 2_000;
 /**
  * Identity of an endpoint for matching purposes: origin and path, with the
  * query string and fragment dropped.
@@ -101,24 +114,53 @@ const TokenCaptureParamsSchema = z
         .optional(),
 })
     .strict();
+/**
+ * Ask the endpoint from inside the page, so the request is the browser's own:
+ * same cookies, same bot-detection clearance the app itself enjoys. Returns
+ * null when the endpoint refuses the request.
+ */
+function requestTokenBody(page, tokenUrl) {
+    return page.evaluate(async (url) => {
+        const response = await fetch(url, { credentials: 'include' });
+        return response.ok ? await response.text() : null;
+    }, tokenUrl);
+}
 /** Store the captured token the way `latchkey auth set -H` would. */
 function buildTokenCredentials(headerTemplate, token) {
     return new RawCurlCredentials(['-H', headerTemplate.replaceAll(TOKEN_PLACEHOLDER, token)]);
 }
 /**
- * One run of the flow: responses go by, and the first one from the mint
- * endpoint that carries a token ends the login.
+ * One run of the flow. The endpoint is both watched and asked, and whichever
+ * produces a token first ends the login.
  */
 class TokenCaptureSession extends SimpleServiceSession {
+    tokenUrl;
     tokenEndpointIdentity;
     tokenPath;
     headerTemplate;
+    lastRequestedAt = 0;
     constructor(service, appNamePrefix, tokenUrl, tokenPath, headerTemplate) {
         super(service, appNamePrefix);
+        this.tokenUrl = tokenUrl;
         this.tokenEndpointIdentity = endpointIdentity(tokenUrl);
         this.tokenPath = tokenPath;
         this.headerTemplate = headerTemplate;
     }
+    /**
+     * Credentials from one body of the endpoint, or null when it carries no
+     * token — including when it is not JSON at all, which is how a bot-detection
+     * interstitial or an error page arrives.
+     */
+    credentialsFromBody(rawBody) {
+        let token;
+        try {
+            token = readTokenAtPath(JSON.parse(rawBody), this.tokenPath);
+        }
+        catch {
+            return null;
+        }
+        return token === null ? null : buildTokenCredentials(this.headerTemplate, token);
+    }
     async getApiCredentialsFromResponse(response) {
         let responseUrl;
         try {
@@ -131,17 +173,61 @@ class TokenCaptureSession extends SimpleServiceSession {
         if (endpointIdentity(responseUrl) !== this.tokenEndpointIdentity) {
             return null;
         }
-        let token;
+        let rawBody;
         try {
-            token = readTokenAtPath(JSON.parse(await response.text()), this.tokenPath);
+            rawBody = await response.text();
         }
         catch {
-            // Unreadable or not JSON: the endpoint answered with something this
-            // registration does not describe. Keep waiting rather than fail the
-            // login — the response that carries the token may still be coming.
+            // The body is no longer retrievable — a redirect, or a response the page
+            // navigated away from. Keep waiting rather than fail the login; the next
+            // request to the endpoint, ours or the app's, gets another chance.
             return null;
         }
-        return token === null ? null : buildTokenCredentials(this.headerTemplate, token);
+        return this.credentialsFromBody(rawBody);
+    }
+    /**
+     * Ask the endpoint ourselves, because an app only calls it when it wants a
+     * token and may never want one while we are watching.
+     *
+     * This waits for the browser to arrive on the endpoint's own origin. The
+     * request is made from inside the page so that it carries the session, and a
+     * cross-origin read of the response would be refused — mid-login the browser
+     * is commonly parked on an identity provider, where there is nothing to ask.
+     */
+    async whileWaitingForLogin(page) {
+        if (Date.now() - this.lastRequestedAt < TOKEN_REQUEST_INTERVAL_MS) {
+            return;
+        }
+        let pageUrl;
+        try {
+            pageUrl = new URL(page.url());
+        }
+        catch {
+            return;
+        }
+        if (pageUrl.origin !== this.tokenUrl.origin) {
+            return;
+        }
+        this.lastRequestedAt = Date.now();
+        let rawBody;
+        try {
+            rawBody = await requestTokenBody(page, this.tokenUrl.href);
+        }
+        catch {
+            // The page navigated out from under the request, or the endpoint could
+            // not be reached. The next poll asks again; a browser the user closed is
+            // caught by the wait loop itself.
+            return;
+        }
+        if (rawBody === null) {
+            return;
+        }
+        const credentials = this.credentialsFromBody(rawBody);
+        // A response may have produced credentials while this request was in
+        // flight, and the first token captured is the one the login keeps.
+        if (credentials !== null && this.apiCredentials === null) {
+            this.apiCredentials = credentials;
+        }
     }
 }
 /**
@@ -168,11 +254,13 @@ export class TokenCaptureLoginFlow {
         'and the page calls an endpoint of its own to mint a short-lived token. Use',
         'cookie-capture instead when the cookie is itself the API credential.',
         '',
-        'The login finishes when that endpoint answers with a non-empty token, not',
-        'when it is merely requested: a signed-out visitor commonly gets the same',
-        'endpoint answering `{}`. A token minted this way expires and cannot be',
-        'refreshed — the refresh material stays in the browser — so expect to sign',
-        'in again periodically.',
+        'The endpoint is both watched and asked: once the browser reaches its',
+        'origin, it is requested from inside the page every couple of seconds, so a',
+        'web app that never calls it unprompted still works. Either way the login',
+        'finishes when it answers with a non-empty token, not when it is merely',
+        'requested: a signed-out visitor commonly gets the same endpoint answering',
+        '`{}`. A token minted this way expires and cannot be refreshed — the refresh',
+        'material stays in the browser — so expect to sign in again periodically.',
         '',
         'Example:',
         '  $ latchkey services register my-app \\',

package/dist/src/services/core/loginFlows/tokenCapture.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokenCapture.js","sourceRoot":"","sources":["../../../../../src/services/core/loginFlows/tokenCapture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAuB,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC1F,OAAO,EAAW,oBAAoB,EAAuB,MAAM,YAAY,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAuC,MAAM,WAAW,CAAC;AAEtF,oEAAoE;AACpE,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAEpC;;;GAGG;AACH,MAAM,uBAAuB,GAAG,yBAAyB,iBAAiB,EAAE,CAAC;AAE7E;;;;;;;;;;;GAWG;AACH,SAAS,gBAAgB,CAAC,GAAQ;IAChC,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,IAAa,EAAE,IAAuB;IAC7D,IAAI,OAAO,GAAY,IAAI,CAAC;IAC5B,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;QAC3B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAI,OAAmC,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACxE,CAAC;AAED,MAAM,wBAAwB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN;;;OAGG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC1B;;;;;OAKG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B;;;;OAIG;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE;QACpD,OAAO,EAAE,oBAAoB,iBAAiB,cAAc;KAC7D,CAAC;SACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QAC1C,OAAO,EAAE,yDAAyD;KACnE,CAAC;SACD,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,qEAAqE;AACrE,SAAS,qBAAqB,CAAC,cAAsB,EAAE,KAAa;IAClE,OAAO,IAAI,kBAAkB,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;;GAGG;AACH,MAAM,mBAAoB,SAAQ,oBAAoB;IACnC,qBAAqB,CAAS;IAC9B,SAAS,CAAoB;IAC7B,cAAc,CAAS;IAExC,YACE,OAAgB,EAChB,aAAqB,EACrB,QAAa,EACb,SAA4B,EAC5B,cAAsB;QAEtB,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC9B,IAAI,CAAC,qBAAqB,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAES,KAAK,CAAC,6BAA6B,CAC3C,QAAkB;QAElB,IAAI,WAAgB,CAAC;QACrB,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,gBAAgB,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACjE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,KAAoB,CAAC;QACzB,IAAI,CAAC;YACH,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,oEAAoE;YACpE,mEAAmE;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACnF,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,qBAAqB;IAChC,0EAA0E;IAC1E,MAAM,CAAU,QAAQ,GAAG,eAAe,CAAC;IAE3C,MAAM,CAAU,OAAO,GACrB,qFAAqF;QACrF,2BAA2B,CAAC;IAE9B,MAAM,CAAU,OAAO,GAAG;QACxB,aAAa;QACb,8EAA8E;QAC9E,6EAA6E;QAC7E,2EAA2E;QAC3E,6EAA6E;QAC7E,uDAAuD;QACvD,mEAAmE;QACnE,kBAAkB,uBAAuB,mBAAmB,iBAAiB,GAAG;QAChF,EAAE;QACF,2EAA2E;QAC3E,4EAA4E;QAC5E,sEAAsE;QACtE,EAAE;QACF,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,2EAA2E;QAC3E,wBAAwB;QACxB,EAAE;QACF,UAAU;QACV,0CAA0C;QAC1C,gEAAgE;QAChE,2DAA2D;QAC3D,qCAAqC;QACrC,sFAAsF;QACtF,4DAA4D;KAC7D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,CAAU,YAAY,GAAG,wBAAwB,CAAC;IAEvC,MAAM,CAAqB;IAE5C,YAAY,SAAkB;QAC5B,IAAI,CAAC,MAAM,GAAG,oBAAoB,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC;IACvE,CAAC;IAED,QAAQ,CAAC,QAAgB;QACvB,OAAO,CACL,mCAAmC,QAAQ,oBAAoB,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI;YACzF,YAAY,IAAI,CAAC,MAAM,CAAC,QAAQ,8CAA8C,CAC/E,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,OAAgB,EAAE,aAAqB;QACnD,OAAO,IAAI,mBAAmB,CAC5B,OAAO,EACP,aAAa,EACb,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC7B,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EACjC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,uBAAuB,CAC9C,CAAC;IACJ,CAAC;;AAGH,gFAAgF;AAChF,2EAA2E;AAC3E,qBAA8C,CAAC"}
+{"version":3,"file":"tokenCapture.js","sourceRoot":"","sources":["../../../../../src/services/core/loginFlows/tokenCapture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAuB,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC1F,OAAO,EAAW,oBAAoB,EAAuB,MAAM,YAAY,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAuC,MAAM,WAAW,CAAC;AAEtF,oEAAoE;AACpE,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAEpC;;;GAGG;AACH,MAAM,uBAAuB,GAAG,yBAAyB,iBAAiB,EAAE,CAAC;AAE7E;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAExC;;;;;;;;;;;GAWG;AACH,SAAS,gBAAgB,CAAC,GAAQ;IAChC,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,IAAa,EAAE,IAAuB;IAC7D,IAAI,OAAO,GAAY,IAAI,CAAC;IAC5B,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;QAC3B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAI,OAAmC,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACxE,CAAC;AAED,MAAM,wBAAwB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN;;;OAGG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC1B;;;;;OAKG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B;;;;OAIG;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE;QACpD,OAAO,EAAE,oBAAoB,iBAAiB,cAAc;KAC7D,CAAC;SACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QAC1C,OAAO,EAAE,yDAAyD;KACnE,CAAC;SACD,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAU,EAAE,QAAgB;IACpD,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACjC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC,EAAE,QAAQ,CAAC,CAAC;AACf,CAAC;AAED,qEAAqE;AACrE,SAAS,qBAAqB,CAAC,cAAsB,EAAE,KAAa;IAClE,OAAO,IAAI,kBAAkB,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;;GAGG;AACH,MAAM,mBAAoB,SAAQ,oBAAoB;IACnC,QAAQ,CAAM;IACd,qBAAqB,CAAS;IAC9B,SAAS,CAAoB;IAC7B,cAAc,CAAS;IAChC,eAAe,GAAG,CAAC,CAAC;IAE5B,YACE,OAAgB,EAChB,aAAqB,EACrB,QAAa,EACb,SAA4B,EAC5B,cAAsB;QAEtB,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,qBAAqB,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACK,mBAAmB,CAAC,OAAe;QACzC,IAAI,KAAoB,CAAC;QACzB,IAAI,CAAC;YACH,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACnF,CAAC;IAES,KAAK,CAAC,6BAA6B,CAC3C,QAAkB;QAElB,IAAI,WAAgB,CAAC;QACrB,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,gBAAgB,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACjE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,yEAAyE;YACzE,mEAAmE;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;OAQG;IACM,KAAK,CAAC,oBAAoB,CAAC,IAAU;QAC5C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,eAAe,GAAG,yBAAyB,EAAE,CAAC;YAClE,OAAO;QACT,CAAC;QAED,IAAI,OAAY,CAAC;QACjB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC5C,OAAO;QACT,CAAC;QACD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAElC,IAAI,OAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,yEAAyE;YACzE,kCAAkC;YAClC,OAAO;QACT,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACtD,qEAAqE;QACrE,mEAAmE;QACnE,IAAI,WAAW,KAAK,IAAI,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACzD,IAAI,CAAC,cAAc,GAAG,WAAW,CAAC;QACpC,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,qBAAqB;IAChC,0EAA0E;IAC1E,MAAM,CAAU,QAAQ,GAAG,eAAe,CAAC;IAE3C,MAAM,CAAU,OAAO,GACrB,qFAAqF;QACrF,2BAA2B,CAAC;IAE9B,MAAM,CAAU,OAAO,GAAG;QACxB,aAAa;QACb,8EAA8E;QAC9E,6EAA6E;QAC7E,2EAA2E;QAC3E,6EAA6E;QAC7E,uDAAuD;QACvD,mEAAmE;QACnE,kBAAkB,uBAAuB,mBAAmB,iBAAiB,GAAG;QAChF,EAAE;QACF,2EAA2E;QAC3E,4EAA4E;QAC5E,sEAAsE;QACtE,EAAE;QACF,sEAAsE;QACtE,4EAA4E;QAC5E,0EAA0E;QAC1E,wEAAwE;QACxE,2EAA2E;QAC3E,6EAA6E;QAC7E,0EAA0E;QAC1E,EAAE;QACF,UAAU;QACV,0CAA0C;QAC1C,gEAAgE;QAChE,2DAA2D;QAC3D,qCAAqC;QACrC,sFAAsF;QACtF,4DAA4D;KAC7D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,CAAU,YAAY,GAAG,wBAAwB,CAAC;IAEvC,MAAM,CAAqB;IAE5C,YAAY,SAAkB;QAC5B,IAAI,CAAC,MAAM,GAAG,oBAAoB,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC;IACvE,CAAC;IAED,QAAQ,CAAC,QAAgB;QACvB,OAAO,CACL,mCAAmC,QAAQ,oBAAoB,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI;YACzF,YAAY,IAAI,CAAC,MAAM,CAAC,QAAQ,8CAA8C,CAC/E,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,OAAgB,EAAE,aAAqB;QACnD,OAAO,IAAI,mBAAmB,CAC5B,OAAO,EACP,aAAa,EACb,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC7B,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EACjC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,uBAAuB,CAC9C,CAAC;IACJ,CAAC;;AAGH,gFAAgF;AAChF,2EAA2E;AAC3E,qBAA8C,CAAC"}

package/dist/src/services/slack.d.ts

@@ -1,10 +1,10 @@
 /**
  * Slack service implementation.
  */
-import type { Response } from 'playwright';
+import type { Page, Response } from 'playwright';
 import { z } from 'zod';
 import type { ApiCredentials } from '../apiCredentials/base.js';
-import { Service, SimpleServiceSession } from './core/base.js';
+import { LoginFailedError, Service, SimpleServiceSession } from './core/base.js';
 /**
  * Slack-specific credentials (token + d cookie).
  */
@@ -32,9 +32,41 @@ export declare class SlackApiCredentials implements ApiCredentials {
     toJSON(): SlackApiCredentialsData;
     static fromJSON(data: SlackApiCredentialsData): SlackApiCredentials;
 }
+/**
+ * Slack signed the user in but the browser has no `d` session cookie, which the
+ * API needs alongside the token. Observed after "Reject cookies" in Slack's
+ * cookie dialog.
+ */
+export declare class SlackSessionCookieMissingError extends LoginFailedError {
+    constructor();
+}
+/**
+ * The Slack client loaded, so the user is signed in, but none of its responses
+ * carried a session token.
+ */
+export declare class SlackTokenMissingError extends LoginFailedError {
+    constructor();
+}
 declare class SlackServiceSession extends SimpleServiceSession {
-    private pendingDCookie;
+    /** Token seen in a response that did not carry the `d` cookie. */
+    private pendingToken;
+    /** When the Slack client was first seen fully loaded, or null until then. */
+    private clientLoadedAt;
     protected getApiCredentialsFromResponse(response: Response): Promise<ApiCredentials | null>;
+    /**
+     * Notice a login that is stuck: Slack has signed the user in, yet the two
+     * things the credentials are made of have not both turned up.
+     *
+     * A token whose request did not carry the `d` cookie is paired with the
+     * cookie from the browser's jar. If the jar has none either, the login is
+     * given up on at once: the cookie is set at sign-in, before Slack serves
+     * anything containing a token, so it is not still coming.
+     *
+     * Without a token, the login is given up on once the client has finished
+     * loading and has then had ample time to make its own requests without any
+     * of them carrying one.
+     */
+    whileWaitingForLogin(page: Page): Promise<void>;
 }
 export declare class Slack extends Service {
     readonly name = "slack";

package/dist/src/services/slack.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"slack.d.ts","sourceRoot":"","sources":["../../../src/services/slack.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAG/D;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;EAIpC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAEhF,qBAAa,mBAAoB,YAAW,cAAc;IACxD,QAAQ,CAAC,UAAU,EAAG,OAAO,CAAU;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEb,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAK1C,kBAAkB,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAUhF,SAAS,IAAI,OAAO,GAAG,SAAS;IAIhC,MAAM,IAAI,uBAAuB;IAQjC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,GAAG,mBAAmB;CAGpE;AAED,cAAM,mBAAoB,SAAQ,oBAAoB;IACpD,OAAO,CAAC,cAAc,CAAuB;cAE7B,6BAA6B,CAC3C,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;CAmClC;AAED,qBAAa,KAAM,SAAQ,OAAO;IAChC,QAAQ,CAAC,IAAI,WAAW;IACxB,QAAQ,CAAC,WAAW,WAAW;IAC/B,QAAQ,CAAC,WAAW,kEAAmE;IACvF,QAAQ,CAAC,QAAQ,8BAA8B;IAC/C,QAAQ,CAAC,IAAI,SAEyD;IAEtE,QAAQ,CAAC,4BAA4B,+CAAgD;IAErF,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IAIzC,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,mBAAmB;cAM5C,8BAA8B,CAC/C,eAAe,EAAE,MAAM,EACvB,YAAY,EAAE,MAAM,GACnB,OAAO;IAKD,UAAU,CAAC,cAAc,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAuB5E;AAED,eAAO,MAAM,KAAK,OAAc,CAAC"}
+{"version":3,"file":"slack.d.ts","sourceRoot":"","sources":["../../../src/services/slack.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAGjF;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;EAIpC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAEhF,qBAAa,mBAAoB,YAAW,cAAc;IACxD,QAAQ,CAAC,UAAU,EAAG,OAAO,CAAU;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEb,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAK1C,kBAAkB,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAUhF,SAAS,IAAI,OAAO,GAAG,SAAS;IAIhC,MAAM,IAAI,uBAAuB;IAQjC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,GAAG,mBAAmB;CAGpE;AAwBD;;;;GAIG;AACH,qBAAa,8BAA+B,SAAQ,gBAAgB;;CAQnE;AAED;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,gBAAgB;;CAK3D;AA2BD,cAAM,mBAAoB,SAAQ,oBAAoB;IACpD,kEAAkE;IAClE,OAAO,CAAC,YAAY,CAAuB;IAE3C,6EAA6E;IAC7E,OAAO,CAAC,cAAc,CAAuB;cAE7B,6BAA6B,CAC3C,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IA2BjC;;;;;;;;;;;;OAYG;IACY,oBAAoB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAwB/D;AAED,qBAAa,KAAM,SAAQ,OAAO;IAChC,QAAQ,CAAC,IAAI,WAAW;IACxB,QAAQ,CAAC,WAAW,WAAW;IAC/B,QAAQ,CAAC,WAAW,kEAAmE;IACvF,QAAQ,CAAC,QAAQ,8BAA8B;IAC/C,QAAQ,CAAC,IAAI,SAEyD;IAEtE,QAAQ,CAAC,4BAA4B,+CAAgD;IAErF,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IAIzC,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,mBAAmB;cAM5C,8BAA8B,CAC/C,eAAe,EAAE,MAAM,EACvB,YAAY,EAAE,MAAM,GACnB,OAAO;IAKD,UAAU,CAAC,cAAc,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAuB5E;AAED,eAAO,MAAM,KAAK,OAAc,CAAC"}

package/dist/src/services/slack.js

@@ -2,7 +2,7 @@
  * Slack service implementation.
  */
 import { z } from 'zod';
-import { Service, SimpleServiceSession } from './core/base.js';
+import { LoginFailedError, Service, SimpleServiceSession } from './core/base.js';
 import { fetchAccountFromEndpoint, tryParseJson } from '../apiCredentials/account.js';
 /**
  * Slack-specific credentials (token + d cookie).
@@ -43,38 +43,129 @@ export class SlackApiCredentials {
         return new SlackApiCredentials(data.token, data.dCookie);
     }
 }
+/**
+ * Any host under slack.com. Enterprise Grid workspaces live two labels deep
+ * (`<workspace>.enterprise.slack.com`), so a single optional label is not enough.
+ */
+const SLACK_URL_PATTERN = /^https:\/\/([a-z0-9-]+\.)*slack\.com\//;
+/** Where the browser ends up once Slack considers the user signed in. */
+const SLACK_CLIENT_URL_PATTERN = /^https:\/\/app\.slack\.com\/client(\/|$)/;
+/** The session token, as embedded in the client's HTML or in raw JSON. */
+const API_TOKEN_PATTERN = /"api_token":"(xoxc-[a-zA-Z0-9-]+)"/;
+const D_COOKIE_HEADER_PATTERN = /\bd=([^;]+)/;
+/**
+ * How long after the Slack client has finished loading a token is still waited
+ * for. The token may arrive in the client's HTML or in a request the client
+ * makes afterwards, so this is deliberately generous: it only delays the
+ * failure message, never a login that is going to succeed.
+ */
+const TOKEN_SETTLE_PERIOD_MS = 5_000;
+/**
+ * Slack signed the user in but the browser has no `d` session cookie, which the
+ * API needs alongside the token. Observed after "Reject cookies" in Slack's
+ * cookie dialog.
+ */
+export class SlackSessionCookieMissingError extends LoginFailedError {
+    constructor() {
+        super('Login failed: The browser holds no "d" session cookie. ' +
+            "Maybe you rejected cookies in Slack's cookie dialog?");
+        this.name = 'SlackSessionCookieMissingError';
+    }
+}
+/**
+ * The Slack client loaded, so the user is signed in, but none of its responses
+ * carried a session token.
+ */
+export class SlackTokenMissingError extends LoginFailedError {
+    constructor() {
+        super('Login failed: No session token was found.');
+        this.name = 'SlackTokenMissingError';
+    }
+}
+async function readDCookieFromJar(page) {
+    const cookies = await page.context().cookies();
+    const dCookie = cookies.find((cookie) => cookie.name === 'd' && /(^|\.)slack\.com$/.test(cookie.domain));
+    return dCookie?.value ?? null;
+}
+/**
+ * Whether the browser sits on a fully loaded Slack client. Loading counts
+ * subresources too, so on a slow connection this simply takes longer to become
+ * true. A page mid-navigation cannot be asked and counts as not loaded.
+ */
+async function isSlackClientLoaded(page) {
+    if (!SLACK_CLIENT_URL_PATTERN.test(page.url())) {
+        return false;
+    }
+    try {
+        const readyState = await page.evaluate('document.readyState');
+        return readyState === 'complete';
+    }
+    catch {
+        return false;
+    }
+}
 class SlackServiceSession extends SimpleServiceSession {
-    pendingDCookie = null;
+    /** Token seen in a response that did not carry the `d` cookie. */
+    pendingToken = null;
+    /** When the Slack client was first seen fully loaded, or null until then. */
+    clientLoadedAt = null;
     async getApiCredentialsFromResponse(response) {
         const request = response.request();
-        const url = request.url();
-        // Check if the domain is under slack.com
-        if (!/^https:\/\/([a-z0-9-]+\.)?slack\.com\//.test(url)) {
+        if (!SLACK_URL_PATTERN.test(request.url())) {
             return null;
         }
-        const headers = await request.allHeaders();
-        const cookieHeader = headers.cookie;
-        if (cookieHeader === undefined) {
+        let responseBody;
+        try {
+            responseBody = await response.text();
+        }
+        catch {
+            // The body is no longer retrievable (a redirect, or a page that has
+            // navigated on); other responses get their chance.
             return null;
         }
-        const cookieMatch = /\bd=([^;]+)/.exec(cookieHeader);
-        if (!cookieMatch?.[1]) {
+        const token = API_TOKEN_PATTERN.exec(responseBody)?.[1];
+        if (token === undefined) {
             return null;
         }
-        const dCookie = cookieMatch[1];
-        this.pendingDCookie = dCookie;
-        // Extract token from response body (JSON embedded in HTML or raw JSON)
-        try {
-            const responseBody = await response.text();
-            const tokenMatch = /"api_token":"(xoxc-[a-zA-Z0-9-]+)"/.exec(responseBody);
-            if (tokenMatch?.[1]) {
-                return new SlackApiCredentials(tokenMatch[1], dCookie);
+        this.pendingToken = token;
+        const cookieHeader = (await request.allHeaders()).cookie;
+        const dCookie = cookieHeader === undefined ? undefined : D_COOKIE_HEADER_PATTERN.exec(cookieHeader)?.[1];
+        return dCookie === undefined ? null : new SlackApiCredentials(token, dCookie);
+    }
+    /**
+     * Notice a login that is stuck: Slack has signed the user in, yet the two
+     * things the credentials are made of have not both turned up.
+     *
+     * A token whose request did not carry the `d` cookie is paired with the
+     * cookie from the browser's jar. If the jar has none either, the login is
+     * given up on at once: the cookie is set at sign-in, before Slack serves
+     * anything containing a token, so it is not still coming.
+     *
+     * Without a token, the login is given up on once the client has finished
+     * loading and has then had ample time to make its own requests without any
+     * of them carrying one.
+     */
+    async whileWaitingForLogin(page) {
+        if (this.apiCredentials !== null) {
+            return;
+        }
+        if (this.pendingToken !== null) {
+            const dCookie = await readDCookieFromJar(page);
+            if (dCookie === null) {
+                throw new SlackSessionCookieMissingError();
             }
+            this.apiCredentials = new SlackApiCredentials(this.pendingToken, dCookie);
+            return;
         }
-        catch {
-            // Ignore errors reading response body
+        if (this.clientLoadedAt === null) {
+            if (await isSlackClientLoaded(page)) {
+                this.clientLoadedAt = Date.now();
+            }
+            return;
+        }
+        if (Date.now() - this.clientLoadedAt >= TOKEN_SETTLE_PERIOD_MS) {
+            throw new SlackTokenMissingError();
         }
-        return null;
     }
 }
 export class Slack extends Service {

package/dist/src/services/slack.js.map

@@ -1 +1 @@
-{"version":3,"file":"slack.js","sourceRoot":"","sources":["../../../src/services/slack.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAEtF;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAIH,MAAM,OAAO,mBAAmB;IACrB,UAAU,GAAG,OAAgB,CAAC;IAC9B,KAAK,CAAS;IACd,OAAO,CAAS;IAEzB,YAAY,KAAa,EAAE,OAAe;QACxC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,kBAAkB,CAAC,aAAgC;QACjD,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,IAAI;YACJ,yBAAyB,IAAI,CAAC,KAAK,EAAE;YACrC,IAAI;YACJ,aAAa,IAAI,CAAC,OAAO,EAAE;YAC3B,GAAG,aAAa;SACjB,CAAC,CAAC;IACL,CAAC;IAED,SAAS;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM;QACJ,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAA6B;QAC3C,OAAO,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;CACF;AAED,MAAM,mBAAoB,SAAQ,oBAAoB;IAC5C,cAAc,GAAkB,IAAI,CAAC;IAEnC,KAAK,CAAC,6BAA6B,CAC3C,QAAkB;QAElB,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAE1B,yCAAyC;QACzC,IAAI,CAAC,wCAAwC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;QACpC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;QAE9B,uEAAuE;QACvE,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC3C,MAAM,UAAU,GAAG,oCAAoC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC3E,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpB,OAAO,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,MAAM,OAAO,KAAM,SAAQ,OAAO;IACvB,IAAI,GAAG,OAAO,CAAC;IACf,WAAW,GAAG,OAAO,CAAC;IACtB,WAAW,GAAG,CAAC,wBAAwB,EAAE,0BAA0B,CAAU,CAAC;IAC9E,QAAQ,GAAG,0BAA0B,CAAC;IACtC,IAAI,GACX,wCAAwC;QACxC,mEAAmE,CAAC;IAE7D,4BAA4B,GAAG,CAAC,iCAAiC,CAAU,CAAC;IAErF,qBAAqB,CAAC,WAAmB;QACvC,OAAO,qBAAqB,WAAW,6CAA6C,CAAC;IACvF,CAAC;IAEQ,UAAU,CAAC,aAAqB;QACvC,OAAO,IAAI,mBAAmB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACtD,CAAC;IAED,0EAA0E;IAC1E,+DAA+D;IAC5C,8BAA8B,CAC/C,eAAuB,EACvB,YAAoB;QAEpB,MAAM,IAAI,GAAG,YAAY,CAAC,YAAY,CAA4B,CAAC;QACnE,OAAO,IAAI,EAAE,EAAE,KAAK,IAAI,CAAC;IAC3B,CAAC;IAEQ,UAAU,CAAC,cAA8B;QAChD,OAAO,wBAAwB,CAC7B,cAAc,EACd,IAAI,CAAC,4BAA4B,EACjC,CAAC,YAAY,EAAE,EAAE;YACf,MAAM,IAAI,GAAG,YAAY,CAAC,YAAY,CAI9B,CAAC;YACT,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,uEAAuE;YACvE,yEAAyE;YACzE,yCAAyC;YACzC,MAAM,cAAc,GAClB,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzE,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC;YACnD,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC;QAC3E,CAAC,CACF,CAAC;IACJ,CAAC;CACF;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,EAAE,CAAC"}
+{"version":3,"file":"slack.js","sourceRoot":"","sources":["../../../src/services/slack.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAEtF;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAIH,MAAM,OAAO,mBAAmB;IACrB,UAAU,GAAG,OAAgB,CAAC;IAC9B,KAAK,CAAS;IACd,OAAO,CAAS;IAEzB,YAAY,KAAa,EAAE,OAAe;QACxC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,kBAAkB,CAAC,aAAgC;QACjD,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,IAAI;YACJ,yBAAyB,IAAI,CAAC,KAAK,EAAE;YACrC,IAAI;YACJ,aAAa,IAAI,CAAC,OAAO,EAAE;YAC3B,GAAG,aAAa;SACjB,CAAC,CAAC;IACL,CAAC;IAED,SAAS;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM;QACJ,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAA6B;QAC3C,OAAO,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,iBAAiB,GAAG,wCAAwC,CAAC;AAEnE,yEAAyE;AACzE,MAAM,wBAAwB,GAAG,0CAA0C,CAAC;AAE5E,0EAA0E;AAC1E,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AAE/D,MAAM,uBAAuB,GAAG,aAAa,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAErC;;;;GAIG;AACH,MAAM,OAAO,8BAA+B,SAAQ,gBAAgB;IAClE;QACE,KAAK,CACH,yDAAyD;YACvD,sDAAsD,CACzD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,sBAAuB,SAAQ,gBAAgB;IAC1D;QACE,KAAK,CAAC,2CAA2C,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,KAAK,UAAU,kBAAkB,CAAC,IAAU;IAC1C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAC1B,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAC3E,CAAC;IACF,OAAO,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAAU;IAC3C,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAY,MAAM,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QACvE,OAAO,UAAU,KAAK,UAAU,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,mBAAoB,SAAQ,oBAAoB;IACpD,kEAAkE;IAC1D,YAAY,GAAkB,IAAI,CAAC;IAE3C,6EAA6E;IACrE,cAAc,GAAkB,IAAI,CAAC;IAEnC,KAAK,CAAC,6BAA6B,CAC3C,QAAkB;QAElB,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,mDAAmD;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACxD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;QAE1B,MAAM,YAAY,GAAG,CAAC,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACzD,MAAM,OAAO,GACX,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3F,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChF,CAAC;IAED;;;;;;;;;;;;OAYG;IACM,KAAK,CAAC,oBAAoB,CAAC,IAAU;QAC5C,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,8BAA8B,EAAE,CAAC;YAC7C,CAAC;YACD,IAAI,CAAC,cAAc,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACjC,IAAI,MAAM,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACnC,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,IAAI,sBAAsB,EAAE,CAAC;YAC/D,MAAM,IAAI,sBAAsB,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,KAAM,SAAQ,OAAO;IACvB,IAAI,GAAG,OAAO,CAAC;IACf,WAAW,GAAG,OAAO,CAAC;IACtB,WAAW,GAAG,CAAC,wBAAwB,EAAE,0BAA0B,CAAU,CAAC;IAC9E,QAAQ,GAAG,0BAA0B,CAAC;IACtC,IAAI,GACX,wCAAwC;QACxC,mEAAmE,CAAC;IAE7D,4BAA4B,GAAG,CAAC,iCAAiC,CAAU,CAAC;IAErF,qBAAqB,CAAC,WAAmB;QACvC,OAAO,qBAAqB,WAAW,6CAA6C,CAAC;IACvF,CAAC;IAEQ,UAAU,CAAC,aAAqB;QACvC,OAAO,IAAI,mBAAmB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACtD,CAAC;IAED,0EAA0E;IAC1E,+DAA+D;IAC5C,8BAA8B,CAC/C,eAAuB,EACvB,YAAoB;QAEpB,MAAM,IAAI,GAAG,YAAY,CAAC,YAAY,CAA4B,CAAC;QACnE,OAAO,IAAI,EAAE,EAAE,KAAK,IAAI,CAAC;IAC3B,CAAC;IAEQ,UAAU,CAAC,cAA8B;QAChD,OAAO,wBAAwB,CAC7B,cAAc,EACd,IAAI,CAAC,4BAA4B,EACjC,CAAC,YAAY,EAAE,EAAE;YACf,MAAM,IAAI,GAAG,YAAY,CAAC,YAAY,CAI9B,CAAC;YACT,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,uEAAuE;YACvE,yEAAyE;YACzE,yCAAyC;YACzC,MAAM,cAAc,GAClB,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzE,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC;YACnD,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC;QAC3E,CAAC,CACF,CAAC;IACJ,CAAC;CACF;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,EAAE,CAAC"}

package/dist/src/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "3.10.1";
+export declare const VERSION = "3.11.1";
 //# sourceMappingURL=version.d.ts.map

package/dist/src/version.js

@@ -1,4 +1,4 @@
 // Auto-generated from package.json by scripts/generateVersion.js.
 // Do not edit by hand; run `node scripts/generateVersion.js` to refresh.
-export const VERSION = "3.10.1";
+export const VERSION = "3.11.1";
 //# sourceMappingURL=version.js.map

package/dist/tests/gateway.test.js

@@ -83,6 +83,7 @@ describe('buildCurlArguments', () => {
             ['X-Latchkey-Gateway-Password', 'sekret'],
             ['X-Latchkey-Gateway-Permissions-Override', 'jwt-payload'],
             ['X-Latchkey-Gateway-Account', 'jou'],
+            ['X-Latchkey-Gateway-No-Credentials', '1'],
         ]);
         const args = buildCurlArguments('GET', headers, 'https://api.example.com/test', false);
         expect(args).toContain('Content-Type: application/json');
@@ -90,6 +91,7 @@ describe('buildCurlArguments', () => {
         expect(joined).not.toContain('x-latchkey-gateway-password');
         expect(joined).not.toContain('x-latchkey-gateway-permissions-override');
         expect(joined).not.toContain('x-latchkey-gateway-account');
+        expect(joined).not.toContain('x-latchkey-gateway-no-credentials');
         expect(joined).not.toContain('sekret');
         expect(joined).not.toContain('jwt-payload');
     });
@@ -760,6 +762,99 @@ describe('gateway server', () => {
             expect(body.error).toContain('missing-permissions.json');
         });
     });
+    describe('no-credentials header', () => {
+        const noCredentialsHeaders = { 'X-Latchkey-Gateway-No-Credentials': '1' };
+        const DEFAULT_CREDENTIALS = {
+            slack: { objectType: 'rawCurl', curlArguments: ['-H', 'Authorization: Bearer test-token'] },
+        };
+        // The header is only honored on a gateway that allows forwarding requests
+        // without credential injection.
+        function createPassthroughGateway(optionOverrides = {}) {
+            return createTestGateway(DEFAULT_CREDENTIALS, {}, optionOverrides, {
+                passthroughUnknown: true,
+            });
+        }
+        function headerArgumentsOf(args) {
+            const headerArguments = [];
+            for (let index = 0; index < args.length; index++) {
+                if (args[index] === '-H' && index + 1 < args.length) {
+                    headerArguments.push(args[index + 1]);
+                }
+            }
+            return headerArguments;
+        }
+        it('is refused unless the gateway allows uninjected requests', async () => {
+            gateway = await createTestGateway();
+            const response = await fetch('/gateway/https://slack.com/api/auth.test', {
+                headers: { ...noCredentialsHeaders, Authorization: 'Bearer already-injected' },
+            });
+            expect(response.status).toBe(403);
+            expect(await response.text()).toContain('LATCHKEY_PASSTHROUGH_UNKNOWN');
+            expect(capturedCurlArgs).toEqual([]);
+            expect(capturedPermissionCheckBody).toBeUndefined();
+        });
+        it('forwards the request as received, without injecting stored credentials', async () => {
+            gateway = await createPassthroughGateway();
+            const response = await fetch('/gateway/https://slack.com/api/auth.test', {
+                headers: { ...noCredentialsHeaders, Authorization: 'Bearer already-injected' },
+            });
+            expect(response.status).toBe(200);
+            const headerArguments = headerArgumentsOf(capturedCurlArgs);
+            expect(headerArguments).toContain('Authorization: Bearer already-injected');
+            expect(headerArguments).not.toContain('Authorization: Bearer test-token');
+            expect(capturedCurlArgs).toContain('https://slack.com/api/auth.test');
+        });
+        it('never forwards the header itself upstream', async () => {
+            gateway = await createPassthroughGateway();
+            await fetch('/gateway/https://slack.com/api/auth.test', { headers: noCredentialsHeaders });
+            expect(capturedCurlArgs.join('\n').toLowerCase()).not.toContain('x-latchkey-gateway-no-credentials');
+        });
+        it('still enforces the permission check', async () => {
+            mockPermissionResult = false;
+            gateway = await createPassthroughGateway();
+            const response = await fetch('/gateway/https://slack.com/api/auth.test', {
+                headers: noCredentialsHeaders,
+            });
+            expect(response.status).toBe(403);
+            expect(capturedCurlArgs).toEqual([]);
+        });
+        it('checks permissions against the real request body', async () => {
+            gateway = await createPassthroughGateway();
+            const requestBody = JSON.stringify({ channel: 'general', text: 'hello' });
+            const response = await fetch('/gateway/https://slack.com/api/chat.postMessage', {
+                method: 'POST',
+                headers: { ...noCredentialsHeaders, 'Content-Type': 'application/json' },
+                body: requestBody,
+            });
+            expect(response.status).toBe(200);
+            expect(capturedPermissionCheckBody).toBe(requestBody);
+        });
+        it('does not require the target to match a known service', async () => {
+            gateway = await createPassthroughGateway();
+            const response = await fetch('/gateway/https://unknown-api.example.com/test', {
+                headers: noCredentialsHeaders,
+            });
+            expect(response.status).toBe(200);
+            expect(capturedCurlArgs).toContain('https://unknown-api.example.com/test');
+        });
+        it('still requires the gateway password', async () => {
+            gateway = await createPassthroughGateway({ password: 'sekret' });
+            const unauthenticated = await fetch('/gateway/https://slack.com/api/auth.test', {
+                headers: noCredentialsHeaders,
+            });
+            expect(unauthenticated.status).toBe(401);
+            const authenticated = await fetch('/gateway/https://slack.com/api/auth.test', {
+                headers: { ...noCredentialsHeaders, 'X-Latchkey-Gateway-Password': 'sekret' },
+            });
+            expect(authenticated.status).toBe(200);
+        });
+        it('is ignored when absent, so ordinary requests still get credentials', async () => {
+            gateway = await createPassthroughGateway();
+            const response = await fetch('/gateway/https://slack.com/api/auth.test');
+            expect(response.status).toBe(200);
+            expect(capturedCurlArgs).toContain('Authorization: Bearer test-token');
+        });
+    });
     describe('services registered while the gateway runs', () => {
         const REGISTERED_BASE_URL = 'https://selfhosted.example.com/api/';
         const CREDENTIALS = {