latchkey 3.8.0 → 3.10.0

package/dist/tests/builtinServiceRegistry.js

@@ -0,0 +1,10 @@
+/**
+ * A registry over the services latchkey ships with.
+ *
+ * The CLI and the gateway each build their own registry with
+ * `createServiceRegistry`, since theirs also carry whatever config.json holds.
+ * Tests that only care about the built-in services share this one.
+ */
+import { BUILTIN_SERVICES, ServiceRegistry } from '../src/serviceRegistry.js';
+export const BUILTIN_SERVICE_REGISTRY = new ServiceRegistry(BUILTIN_SERVICES);
+//# sourceMappingURL=builtinServiceRegistry.js.map

package/dist/tests/builtinServiceRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builtinServiceRegistry.js","sourceRoot":"","sources":["../../tests/builtinServiceRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE9E,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,eAAe,CAAC,gBAAgB,CAAC,CAAC"}

package/dist/tests/cli.test.js

@@ -5,12 +5,13 @@ import { tmpdir } from 'node:os';
 import { execSync } from 'node:child_process';
 import { Command } from 'commander';
 import { registerCommands } from '../src/cliCommands.js';
-import { CurlParseError, extractUrlFromCurlArguments } from '../src/curl.js';
+import { CurlParseError, extractUrlFromCurlArguments, resolveCurlRequestBodySource, } from '../src/curl.js';
 import { hasGraphicalEnvironment } from '../src/playwrightUtils.js';
 import { EncryptedStorage } from '../src/encryptedStorage.js';
 import { Config } from '../src/config.js';
 import { ServiceRegistry } from '../src/serviceRegistry.js';
 import { ApiCredentialStatus } from '../src/apiCredentials/base.js';
+import { LATEST_VERSION } from '../src/migrations.js';
 import { Service } from '../src/services/core/base.js';
 import { createMockService, MockService } from './mockService.js';
 import { RegisteredService } from '../src/services/core/registered.js';
@@ -183,6 +184,26 @@ describe('extractUrlFromCurlArguments', () => {
         expect(extractUrlFromCurlArguments(arguments_)).toBe('https://example.com/api?query=from%3Ame');
     });
 });
+describe('resolveCurlRequestBodySource', () => {
+    it('should report an inline body when no file reference is present', () => {
+        expect(resolveCurlRequestBodySource(['-d', '{"a":1}', 'https://example.com'], '{"a":1}')).toEqual({ kind: 'inline', text: '{"a":1}' });
+    });
+    it('should report an inline body for --data-raw, which treats @ literally', () => {
+        expect(resolveCurlRequestBodySource(['--data-raw', '@literal', 'https://example.com'], '@literal')).toEqual({ kind: 'inline', text: '@literal' });
+    });
+    it('should report a file reference', () => {
+        expect(resolveCurlRequestBodySource(['--data-binary', '@/tmp/payload.json', 'https://example.com'], '@/tmp/payload.json')).toEqual({ kind: 'file', path: '/tmp/payload.json' });
+    });
+    it('should report stdin for @-', () => {
+        expect(resolveCurlRequestBodySource(['--data-binary', '@-', 'https://example.com'], '@-')).toEqual({ kind: 'stdin' });
+    });
+    it('should report an unreconstructable body for combined data arguments', () => {
+        expect(resolveCurlRequestBodySource(['-d', '@/tmp/payload.json', '-d', 'extra=1', 'https://example.com'], '@/tmp/payload.json&extra=1')).toEqual({ kind: 'unreconstructable' });
+    });
+    it('should report an unreconstructable body for url-encoded file data', () => {
+        expect(resolveCurlRequestBodySource(['--data-urlencode', '@/tmp/payload.json', 'https://example.com'], '@/tmp/payload.json')).toEqual({ kind: 'unreconstructable' });
+    });
+});
 describe('hasGraphicalEnvironment', () => {
     const originalPlatform = process.platform;
     afterEach(() => {
@@ -345,6 +366,7 @@ describe('CLI commands with dependency injection', () => {
         const mockRegistry = new ServiceRegistry([mockSlackService]);
         return {
             registry: mockRegistry,
+            builtinServices: [mockSlackService],
             config: createMockConfig(),
             runCurl: (args) => {
                 capturedArgs.push(...args);
@@ -973,11 +995,35 @@ describe('CLI commands with dependency injection', () => {
         function withStdinKey(key, overrides = {}) {
             return createMockDependencies({ readStdin: () => Promise.resolve(key), ...overrides });
         }
-        // The credential store filename used by the mock config.
+        // The filenames used by the mock config.
         const STORE_FILENAME = 'credentials.json';
-        function writeStore(contents) {
-            writeSecureFile(join(tempDir, STORE_FILENAME), JSON.stringify(nestAccounts(contents)));
+        const BROWSER_STATE_FILENAME = 'browser_state.json';
+        function writeStore(contents, preparations = {}) {
+            writeSecureFile(join(tempDir, STORE_FILENAME), JSON.stringify({ ...nestAccounts(contents), preparations }));
+        }
+        // Write an on-disk store with explicit account keys.
+        function writeAccountStore(credentials, preparations = {}) {
+            writeSecureFile(join(tempDir, STORE_FILENAME), JSON.stringify({ credentials, preparations }));
         }
+        function readAccountsWithKey(path, key) {
+            const raw = JSON.parse(new EncryptedStorage(key).readFile(path) ?? '{}');
+            return raw.credentials ?? {};
+        }
+        function readPreparationsWithKey(path, key) {
+            const raw = JSON.parse(new EncryptedStorage(key).readFile(path) ?? '{}');
+            return raw.preparations ?? {};
+        }
+        // A destination that already holds a store must be in the current data
+        // format, which real Latchkey directories record in this file.
+        function stampDataFormatVersion(directory) {
+            mkdirSync(directory, { recursive: true });
+            writeFileSync(join(directory, 'data-format-version'), String(LATEST_VERSION));
+        }
+        const GITLAB_PREPARATION = {
+            objectType: 'oauth',
+            clientId: 'gitlab-client-id',
+            clientSecret: 'gitlab-client-secret',
+        };
         it('re-encrypts all stored credentials with the new key', async () => {
             writeStore({
                 slack: { objectType: 'slack', token: 'tok', dCookie: 'cookie' },
@@ -1025,7 +1071,7 @@ describe('CLI commands with dependency injection', () => {
             const reEncrypted = readWithKey(join(destinationDirectory, STORE_FILENAME), NEW_ENCRYPTION_KEY);
             expect(Object.keys(reEncrypted)).toEqual(['slack']);
         });
-        it('errors when a requested service has no stored credentials', async () => {
+        it('errors when a requested service has neither credentials nor a preparation', async () => {
             writeStore({ slack: { objectType: 'slack', token: 'tok', dCookie: 'cookie' } });
             const destinationDirectory = join(tempDir, 'export');
             const deps = withStdinKey(NEW_ENCRYPTION_KEY);
@@ -1033,6 +1079,170 @@ describe('CLI commands with dependency injection', () => {
             expect(exitCode).toBe(1);
             expect(existsSync(join(destinationDirectory, STORE_FILENAME))).toBe(false);
         });
+        it('carries the preparations of the re-encrypted services', async () => {
+            writeStore({ gitlab: { objectType: 'authorizationBearer', token: 'gitlab-token' } }, { gitlab: GITLAB_PREPARATION });
+            const destinationDirectory = join(tempDir, 'export');
+            const deps = withStdinKey(NEW_ENCRYPTION_KEY);
+            await runCommand(['auth', 're-encrypt', destinationDirectory], deps);
+            expect(exitCode).toBeNull();
+            const destination = join(destinationDirectory, STORE_FILENAME);
+            expect(readPreparationsWithKey(destination, NEW_ENCRYPTION_KEY)).toEqual({
+                gitlab: GITLAB_PREPARATION,
+            });
+        });
+        it('includes services that only have a preparation', async () => {
+            writeStore({ slack: { objectType: 'slack', token: 'tok', dCookie: 'cookie' } }, { gitlab: GITLAB_PREPARATION });
+            const destinationDirectory = join(tempDir, 'export');
+            const deps = withStdinKey(NEW_ENCRYPTION_KEY);
+            await runCommand(['auth', 're-encrypt', destinationDirectory], deps);
+            expect(exitCode).toBeNull();
+            const destination = join(destinationDirectory, STORE_FILENAME);
+            expect(Object.keys(readWithKey(destination, NEW_ENCRYPTION_KEY))).toEqual(['slack']);
+            expect(readPreparationsWithKey(destination, NEW_ENCRYPTION_KEY)).toEqual({
+                gitlab: GITLAB_PREPARATION,
+            });
+            expect(logs.join('\n')).toContain('2 service(s)');
+        });
+        it('selects a service that only has a preparation with --services', async () => {
+            writeStore({ slack: { objectType: 'slack', token: 'tok', dCookie: 'cookie' } }, { gitlab: GITLAB_PREPARATION });
+            const destinationDirectory = join(tempDir, 'export');
+            const deps = withStdinKey(NEW_ENCRYPTION_KEY);
+            await runCommand(['auth', 're-encrypt', destinationDirectory, '--services', 'gitlab'], deps);
+            expect(exitCode).toBeNull();
+            const destination = join(destinationDirectory, STORE_FILENAME);
+            expect(readWithKey(destination, NEW_ENCRYPTION_KEY)).toEqual({});
+            expect(readPreparationsWithKey(destination, NEW_ENCRYPTION_KEY)).toEqual({
+                gitlab: GITLAB_PREPARATION,
+            });
+        });
+        it('replaces an existing preparation in the destination', async () => {
+            writeStore({}, { gitlab: GITLAB_PREPARATION });
+            const destinationDirectory = join(tempDir, 'export');
+            const destination = join(destinationDirectory, STORE_FILENAME);
+            stampDataFormatVersion(destinationDirectory);
+            new EncryptedStorage(NEW_ENCRYPTION_KEY).writeFile(destination, JSON.stringify({
+                credentials: {},
+                preparations: {
+                    gitlab: { objectType: 'oauth', clientId: 'old-id', clientSecret: 'old-secret' },
+                },
+            }));
+            const deps = withStdinKey(NEW_ENCRYPTION_KEY);
+            await runCommand(['auth', 're-encrypt', destinationDirectory], deps);
+            expect(exitCode).toBeNull();
+            expect(readPreparationsWithKey(destination, NEW_ENCRYPTION_KEY)).toEqual({
+                gitlab: GITLAB_PREPARATION,
+            });
+        });
+        it('only includes the given account when using --account', async () => {
+            writeAccountStore({
+                slack: {
+                    'work@example.com': { objectType: 'slack', token: 'work-tok', dCookie: 'work-cookie' },
+                    'home@example.com': { objectType: 'slack', token: 'home-tok', dCookie: 'home-cookie' },
+                },
+                gitlab: {
+                    'work@example.com': { objectType: 'authorizationBearer', token: 'gitlab-token' },
+                },
+            }, { gitlab: GITLAB_PREPARATION });
+            const destinationDirectory = join(tempDir, 'export');
+            const deps = withStdinKey(NEW_ENCRYPTION_KEY);
+            await runCommand(['--account', 'work@example.com', 'auth', 're-encrypt', destinationDirectory], deps);
+            expect(exitCode).toBeNull();
+            const destination = join(destinationDirectory, STORE_FILENAME);
+            expect(readAccountsWithKey(destination, NEW_ENCRYPTION_KEY)).toEqual({
+                slack: {
+                    'work@example.com': { objectType: 'slack', token: 'work-tok', dCookie: 'work-cookie' },
+                },
+                gitlab: {
+                    'work@example.com': { objectType: 'authorizationBearer', token: 'gitlab-token' },
+                },
+            });
+            // Preparations are not account-specific and are carried over as usual.
+            expect(readPreparationsWithKey(destination, NEW_ENCRYPTION_KEY)).toEqual({
+                gitlab: GITLAB_PREPARATION,
+            });
+        });
+        it('keeps the other accounts of the destination when using --account', async () => {
+            writeAccountStore({
+                slack: {
+                    'work@example.com': { objectType: 'slack', token: 'new-tok', dCookie: 'new-cookie' },
+                },
+            });
+            const destinationDirectory = join(tempDir, 'export');
+            const destination = join(destinationDirectory, STORE_FILENAME);
+            stampDataFormatVersion(destinationDirectory);
+            new EncryptedStorage(NEW_ENCRYPTION_KEY).writeFile(destination, JSON.stringify({
+                credentials: {
+                    slack: {
+                        'work@example.com': { objectType: 'slack', token: 'old-tok', dCookie: 'old-cookie' },
+                        'home@example.com': {
+                            objectType: 'slack',
+                            token: 'home-tok',
+                            dCookie: 'home-cookie',
+                        },
+                    },
+                },
+                preparations: {},
+            }));
+            const deps = withStdinKey(NEW_ENCRYPTION_KEY);
+            await runCommand(['--account', 'work@example.com', 'auth', 're-encrypt', destinationDirectory], deps);
+            expect(exitCode).toBeNull();
+            expect(readAccountsWithKey(destination, NEW_ENCRYPTION_KEY)).toEqual({
+                slack: {
+                    'work@example.com': { objectType: 'slack', token: 'new-tok', dCookie: 'new-cookie' },
+                    'home@example.com': { objectType: 'slack', token: 'home-tok', dCookie: 'home-cookie' },
+                },
+            });
+        });
+        it('leaves the destination account alone when the source does not have it', async () => {
+            writeAccountStore({
+                slack: {
+                    'work@example.com': { objectType: 'slack', token: 'work-tok', dCookie: 'work-cookie' },
+                },
+            }, { gitlab: GITLAB_PREPARATION });
+            const destinationDirectory = join(tempDir, 'export');
+            const destination = join(destinationDirectory, STORE_FILENAME);
+            stampDataFormatVersion(destinationDirectory);
+            new EncryptedStorage(NEW_ENCRYPTION_KEY).writeFile(destination, JSON.stringify({
+                credentials: {
+                    // gitlab only has a preparation in the source, so its credentials
+                    // in the destination must survive.
+                    gitlab: {
+                        'work@example.com': {
+                            objectType: 'authorizationBearer',
+                            token: 'destination-token',
+                        },
+                    },
+                },
+                preparations: {},
+            }));
+            const deps = withStdinKey(NEW_ENCRYPTION_KEY);
+            await runCommand(['--account', 'work@example.com', 'auth', 're-encrypt', destinationDirectory], deps);
+            expect(exitCode).toBeNull();
+            expect(readAccountsWithKey(destination, NEW_ENCRYPTION_KEY)).toEqual({
+                gitlab: {
+                    'work@example.com': { objectType: 'authorizationBearer', token: 'destination-token' },
+                },
+                slack: {
+                    'work@example.com': { objectType: 'slack', token: 'work-tok', dCookie: 'work-cookie' },
+                },
+            });
+            expect(readPreparationsWithKey(destination, NEW_ENCRYPTION_KEY)).toEqual({
+                gitlab: GITLAB_PREPARATION,
+            });
+        });
+        it('errors when no stored credentials belong to the given account', async () => {
+            writeAccountStore({
+                slack: {
+                    'work@example.com': { objectType: 'slack', token: 'work-tok', dCookie: 'work-cookie' },
+                },
+            });
+            const destinationDirectory = join(tempDir, 'export');
+            const deps = withStdinKey(NEW_ENCRYPTION_KEY);
+            await runCommand(['--account', 'missing@example.com', 'auth', 're-encrypt', destinationDirectory], deps);
+            expect(exitCode).toBe(1);
+            expect(errorLogs.join('\n')).toContain('missing@example.com');
+            expect(existsSync(join(destinationDirectory, STORE_FILENAME))).toBe(false);
+        });
         it('errors for an invalid encryption key read from stdin', async () => {
             writeStore({});
             const destinationDirectory = join(tempDir, 'export');
@@ -1049,10 +1259,36 @@ describe('CLI commands with dependency injection', () => {
             expect(exitCode).toBeNull();
             expect(Object.keys(readWithKey(join(destinationDirectory, STORE_FILENAME), NEW_ENCRYPTION_KEY))).toEqual(['slack']);
         });
-        it('refuses to overwrite an existing credential store in the destination', async () => {
+        it('adds the services into an existing credential store, overwriting by service', async () => {
+            writeStore({
+                slack: { objectType: 'slack', token: 'new-tok', dCookie: 'new-cookie' },
+            });
+            const destinationDirectory = join(tempDir, 'export');
+            const destination = join(destinationDirectory, STORE_FILENAME);
+            stampDataFormatVersion(destinationDirectory);
+            new EncryptedStorage(NEW_ENCRYPTION_KEY).writeFile(destination, JSON.stringify(nestAccounts({
+                slack: { objectType: 'slack', token: 'old-tok', dCookie: 'old-cookie' },
+                discord: { objectType: 'authorizationBearer', token: 'discord-token' },
+            })));
+            const deps = withStdinKey(NEW_ENCRYPTION_KEY);
+            await runCommand(['auth', 're-encrypt', destinationDirectory], deps);
+            expect(exitCode).toBeNull();
+            const reEncrypted = readWithKey(destination, NEW_ENCRYPTION_KEY);
+            expect(Object.keys(reEncrypted).sort()).toEqual(['discord', 'slack']);
+            expect(reEncrypted.slack).toEqual({
+                objectType: 'slack',
+                token: 'new-tok',
+                dCookie: 'new-cookie',
+            });
+            expect(reEncrypted.discord).toEqual({
+                objectType: 'authorizationBearer',
+                token: 'discord-token',
+            });
+        });
+        it('errors when the existing credential store cannot be read with the new key', async () => {
             writeStore({ slack: { objectType: 'slack', token: 'tok', dCookie: 'cookie' } });
             const destinationDirectory = join(tempDir, 'export');
-            mkdirSync(destinationDirectory);
+            stampDataFormatVersion(destinationDirectory);
             const destination = join(destinationDirectory, STORE_FILENAME);
             writeFileSync(destination, 'existing');
             const deps = withStdinKey(NEW_ENCRYPTION_KEY);
@@ -1060,6 +1296,36 @@ describe('CLI commands with dependency injection', () => {
             expect(exitCode).toBe(1);
             expect(readFileSync(destination, 'utf-8')).toBe('existing');
         });
+        it('re-encrypts the browser state with --browser-state', async () => {
+            writeStore({ slack: { objectType: 'slack', token: 'tok', dCookie: 'cookie' } });
+            new EncryptedStorage(TEST_ENCRYPTION_KEY).writeFile(join(tempDir, BROWSER_STATE_FILENAME), '{"cookies":[]}');
+            const destinationDirectory = join(tempDir, 'export');
+            const deps = withStdinKey(NEW_ENCRYPTION_KEY);
+            await runCommand(['auth', 're-encrypt', destinationDirectory, '--browser-state'], deps);
+            expect(exitCode).toBeNull();
+            const browserStateDestination = join(destinationDirectory, BROWSER_STATE_FILENAME);
+            expect(new EncryptedStorage(NEW_ENCRYPTION_KEY).readFile(browserStateDestination)).toBe('{"cookies":[]}');
+            expect(Object.keys(readWithKey(join(destinationDirectory, STORE_FILENAME), NEW_ENCRYPTION_KEY))).toEqual(['slack']);
+        });
+        it('errors with --browser-state when there is no browser state', async () => {
+            writeStore({ slack: { objectType: 'slack', token: 'tok', dCookie: 'cookie' } });
+            const destinationDirectory = join(tempDir, 'export');
+            const deps = withStdinKey(NEW_ENCRYPTION_KEY);
+            await runCommand(['auth', 're-encrypt', destinationDirectory, '--browser-state'], deps);
+            expect(exitCode).toBe(1);
+            expect(existsSync(join(destinationDirectory, STORE_FILENAME))).toBe(false);
+        });
+        it('overwrites an existing browser state in the destination', async () => {
+            writeStore({});
+            new EncryptedStorage(TEST_ENCRYPTION_KEY).writeFile(join(tempDir, BROWSER_STATE_FILENAME), '{"cookies":["new"]}');
+            const destinationDirectory = join(tempDir, 'export');
+            const browserStateDestination = join(destinationDirectory, BROWSER_STATE_FILENAME);
+            new EncryptedStorage(NEW_ENCRYPTION_KEY).writeFile(browserStateDestination, 'old');
+            const deps = withStdinKey(NEW_ENCRYPTION_KEY);
+            await runCommand(['auth', 're-encrypt', destinationDirectory, '--browser-state'], deps);
+            expect(exitCode).toBeNull();
+            expect(new EncryptedStorage(NEW_ENCRYPTION_KEY).readFile(browserStateDestination)).toBe('{"cookies":["new"]}');
+        });
         it('errors when the destination is an existing file, not a directory', async () => {
             writeStore({ slack: { objectType: 'slack', token: 'tok', dCookie: 'cookie' } });
             const destinationDirectory = join(tempDir, 'export');