latchkey 3.9.0 → 3.10.0

package/dist/tests/tokenCapture.test.js

@@ -0,0 +1,136 @@
+/**
+ * Tests for the generic token-capturing browser login used by registered
+ * services.
+ *
+ * Everything goes through the public path a real login takes — a flow, the
+ * service it is registered on, and the session that service hands out — with
+ * responses fed in by hand instead of by a browser.
+ */
+import { describe, it, expect } from 'vitest';
+import { TokenCaptureLoginFlow } from '../src/services/core/loginFlows/tokenCapture.js';
+import { LOGIN_FLOWS, resolveLoginFlow } from '../src/services/core/loginFlows/registry.js';
+import { LoginFlowParamsInvalidError } from '../src/services/core/loginFlows/base.js';
+import { RegisteredService } from '../src/services/core/registered.js';
+import { SimpleServiceSession } from '../src/services/index.js';
+const LOGIN_URL = 'https://app.example.com/auth/login';
+const TOKEN_URL = 'https://app.example.com/api/auth/session';
+/** A response carrying the JSON body under test. */
+function responseWith(body, url) {
+    return {
+        url: () => url,
+        text: () => Promise.resolve(body),
+        headersArray: () => Promise.resolve([{ name: 'Content-Type', value: 'application/json' }]),
+    };
+}
+async function headerFrom(credentials) {
+    if (credentials === null) {
+        return null;
+    }
+    const curlArguments = await credentials.injectIntoCurlCall([]);
+    return curlArguments[1] ?? null;
+}
+/**
+ * A login in progress for a service registered with these parameters: responses
+ * go in, and out comes the header stored so far, or null.
+ */
+function startLogin(params) {
+    const service = new RegisteredService('my-service', 'https://app.example.com/backend-api/', {
+        loginUrl: LOGIN_URL,
+        loginFlow: new TokenCaptureLoginFlow({
+            tokenUrl: params.tokenUrl ?? TOKEN_URL,
+            tokenField: params.tokenField ?? 'accessToken',
+            ...(params.header === undefined ? {} : { header: params.header }),
+        }),
+    });
+    const session = service.getSession('latchkey');
+    if (!(session instanceof SimpleServiceSession)) {
+        throw new TypeError('the token-capture flow should hand out a SimpleServiceSession');
+    }
+    return async (body, responseUrl = TOKEN_URL) => {
+        await session.onResponse(responseWith(body, responseUrl));
+        return headerFrom(session.capturedCredentials);
+    };
+}
+describe('token capture', () => {
+    it('captures a token from the named endpoint', async () => {
+        const respond = startLogin({});
+        expect(await respond('{"accessToken": "tok-123", "user": {"email": "a@example.com"}}')).toBe('Authorization: Bearer tok-123');
+    });
+    // The signal is the token, not the request: the same endpoint answers a
+    // signed-out visitor, and treating that as a finished login would store
+    // nothing and call it success.
+    it('is not complete while the endpoint answers without a token', async () => {
+        const respond = startLogin({});
+        expect(await respond('{}')).toBeNull();
+        expect(await respond('{"accessToken": null}')).toBeNull();
+        expect(await respond('{"accessToken": ""}')).toBeNull();
+        expect(await respond('{"accessToken": "tok-123"}')).toBe('Authorization: Bearer tok-123');
+    });
+    it('ignores responses from other endpoints', async () => {
+        const respond = startLogin({});
+        expect(await respond('{"accessToken": "not-this-one"}', 'https://app.example.com/api/profile')).toBeNull();
+        expect(await respond('{"accessToken": "nor-this"}', 'https://identity-provider.example.net/session')).toBeNull();
+    });
+    // A mint endpoint is commonly called with a parameter the registrant cannot
+    // predict — NextAuth appends one — so matching the URL verbatim would mean
+    // the flow silently never fires.
+    it('matches the endpoint regardless of query string', async () => {
+        const respond = startLogin({});
+        expect(await respond('{"accessToken": "tok"}', `${TOKEN_URL}?_rsc=1a2b3`)).toBe('Authorization: Bearer tok');
+    });
+    it('reads a nested field', async () => {
+        const respond = startLogin({ tokenField: 'data.session.token' });
+        expect(await respond('{"data": {"session": {"token": "deep"}}}')).toBe('Authorization: Bearer deep');
+    });
+    it('does not mistake a non-object on the path for a token', async () => {
+        const respond = startLogin({ tokenField: 'data.token' });
+        expect(await respond('{"data": null}')).toBeNull();
+        expect(await respond('{"data": ["token"]}')).toBeNull();
+        expect(await respond('{"data": {"token": 42}}')).toBeNull();
+    });
+    // Waiting rather than failing: the response that carries the token may still
+    // be coming, and a login that aborted on the first unparseable body would be
+    // at the mercy of anything else the page fetches from that path.
+    it('keeps waiting through a body that is not JSON', async () => {
+        const respond = startLogin({});
+        expect(await respond('<!doctype html><title>Just a moment...</title>')).toBeNull();
+        expect(await respond('{"accessToken": "tok"}')).toBe('Authorization: Bearer tok');
+    });
+    it('stores the token in a custom header when one is registered', async () => {
+        const respond = startLogin({ header: 'X-Auth-Token: {token}' });
+        expect(await respond('{"accessToken": "tok"}')).toBe('X-Auth-Token: tok');
+    });
+});
+describe('token capture parameters', () => {
+    it('is registered under its flow name', () => {
+        expect(LOGIN_FLOWS.map((flow) => flow.flowName)).toContain('token-capture');
+        expect(resolveLoginFlow('token-capture', { tokenUrl: TOKEN_URL, tokenField: 'accessToken' })).toBeInstanceOf(TokenCaptureLoginFlow);
+    });
+    it('requires a URL and a field', () => {
+        expect(() => new TokenCaptureLoginFlow({})).toThrow(LoginFlowParamsInvalidError);
+        expect(() => new TokenCaptureLoginFlow({ tokenUrl: TOKEN_URL })).toThrow(LoginFlowParamsInvalidError);
+        expect(() => new TokenCaptureLoginFlow({ tokenUrl: 'not-a-url', tokenField: 'a' })).toThrow(LoginFlowParamsInvalidError);
+    });
+    // Caught at registration rather than as a puzzling 401 after a
+    // successful-looking login.
+    it('rejects a header that could not carry the token', () => {
+        const base = { tokenUrl: TOKEN_URL, tokenField: 'accessToken' };
+        expect(() => new TokenCaptureLoginFlow({ ...base, header: 'Authorization: Bearer' })).toThrow(LoginFlowParamsInvalidError);
+        expect(() => new TokenCaptureLoginFlow({ ...base, header: 'no colon {token}' })).toThrow(LoginFlowParamsInvalidError);
+    });
+    it('rejects unknown parameters', () => {
+        expect(() => new TokenCaptureLoginFlow({
+            tokenUrl: TOKEN_URL,
+            tokenField: 'accessToken',
+            cookieKeys: ['sessionid'],
+        })).toThrow(LoginFlowParamsInvalidError);
+    });
+    it('describes itself for `services info`', () => {
+        const flow = new TokenCaptureLoginFlow({ tokenUrl: TOKEN_URL, tokenField: 'accessToken' });
+        const description = flow.describe(LOGIN_URL);
+        expect(description).toContain(LOGIN_URL);
+        expect(description).toContain(TOKEN_URL);
+        expect(description).toContain('accessToken');
+    });
+});
+//# sourceMappingURL=tokenCapture.test.js.map

package/dist/tests/tokenCapture.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenCapture.test.js","sourceRoot":"","sources":["../../tests/tokenCapture.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAG9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAC;AACxF,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,yCAAyC,CAAC;AACtF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE,MAAM,SAAS,GAAG,oCAAoC,CAAC;AACvD,MAAM,SAAS,GAAG,0CAA0C,CAAC;AAE7D,oDAAoD;AACpD,SAAS,YAAY,CAAC,IAAY,EAAE,GAAW;IAC7C,OAAO;QACL,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG;QACd,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACjC,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;KACpE,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,WAAkC;IAC1D,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,MAInB;IACC,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC,YAAY,EAAE,sCAAsC,EAAE;QAC1F,QAAQ,EAAE,SAAS;QACnB,SAAS,EAAE,IAAI,qBAAqB,CAAC;YACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS;YACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,aAAa;YAC9C,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;SAClE,CAAC;KACH,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,OAAO,CAAC,UAAW,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC,CAAC,OAAO,YAAY,oBAAoB,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,SAAS,CAAC,+DAA+D,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,KAAK,EAAE,IAAI,EAAE,WAAW,GAAG,SAAS,EAAE,EAAE;QAC7C,MAAM,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;QAC1D,OAAO,UAAU,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACjD,CAAC,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,OAAO,CAAC,gEAAgE,CAAC,CAAC,CAAC,IAAI,CAC1F,+BAA+B,CAChC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,wEAAwE;IACxE,+BAA+B;IAC/B,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,CAAC,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC1D,MAAM,CAAC,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxD,MAAM,CAAC,MAAM,OAAO,CAAC,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,CACJ,MAAM,OAAO,CAAC,iCAAiC,EAAE,qCAAqC,CAAC,CACxF,CAAC,QAAQ,EAAE,CAAC;QACb,MAAM,CACJ,MAAM,OAAO,CAAC,6BAA6B,EAAE,+CAA+C,CAAC,CAC9F,CAAC,QAAQ,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,2EAA2E;IAC3E,iCAAiC;IACjC,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,OAAO,CAAC,wBAAwB,EAAE,GAAG,SAAS,aAAa,CAAC,CAAC,CAAC,IAAI,CAC7E,2BAA2B,CAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;QACpC,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,OAAO,CAAC,0CAA0C,CAAC,CAAC,CAAC,IAAI,CACpE,4BAA4B,CAC7B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnD,MAAM,CAAC,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxD,MAAM,CAAC,MAAM,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,6EAA6E;IAC7E,iEAAiE;IACjE,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,OAAO,CAAC,gDAAgD,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnF,MAAM,CAAC,MAAM,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC5E,MAAM,CACJ,gBAAgB,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CACtF,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;QACjF,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,CACtE,2BAA2B,CAC5B,CAAC;QACF,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CACzF,2BAA2B,CAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAC/D,4BAA4B;IAC5B,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;QAChE,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,qBAAqB,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,OAAO,CAC3F,2BAA2B,CAC5B,CAAC;QACF,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,qBAAqB,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,OAAO,CACtF,2BAA2B,CAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CACJ,GAAG,EAAE,CACH,IAAI,qBAAqB,CAAC;YACxB,QAAQ,EAAE,SAAS;YACnB,UAAU,EAAE,aAAa;YACzB,UAAU,EAAE,CAAC,WAAW,CAAC;SAC1B,CAAC,CACL,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,IAAI,GAAG,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC;QAC3F,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "latchkey",
-  "version": "3.9.0",
+  "version": "3.10.0",
   "description": "A CLI tool that injects API credentials into curl requests to third-party services",
   "author": "Imbue <hynek@imbue.com>",
   "repository": {
@@ -60,7 +60,7 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@imbue-ai/detent": "^1.15.0",
+    "@imbue-ai/detent": "^1.15.1",
     "@napi-rs/keyring": "^1.2.0",
     "commander": "^12.0.0",
     "playwright": "~1.60.0",