logwork-cli 1.1.1 → 1.2.0

package/lib/api-auth-forms.mjs

@@ -0,0 +1,393 @@
+// Keycloak HTML form parsing (login, password update, device choice, OTP) and
+// form submission.
+import { safeApiAuthError } from './api-auth-support.mjs';
+
+export function findKeycloakAuthUrl(html, baseUrl) {
+  const matches = String(html || '').match(/https:\/\/keycloak\.vinova\.sg\/auth\/realms\/resource\/protocol\/openid-connect\/auth[^"' <]+/i);
+  if (matches?.[0]) {
+    return decodeHtml(matches[0]);
+  }
+
+  const href = findAttributeValue(html, 'href', /keycloak\.vinova\.sg\/auth\/realms\/resource\/protocol\/openid-connect\/auth/i);
+  if (href) {
+    return new URL(decodeHtml(href), baseUrl).toString();
+  }
+
+  return null;
+}
+
+export function selectNextKeycloakForm(html, baseUrl, { preferDevice = false } = {}) {
+  const forms = parseHtmlForms(html, baseUrl);
+  const passwordUpdate = forms.find((form) => form.kind === 'password-update');
+  const credentials = forms.find((form) => form.kind === 'credentials');
+  const otp = forms.find((form) => form.kind === 'otp');
+  const device = forms.find((form) => form.kind === 'device' || form.devices.length > 0);
+
+  if (passwordUpdate) {
+    return passwordUpdate;
+  }
+  if (credentials) {
+    return credentials;
+  }
+  if (otp) {
+    return otp;
+  }
+  if (preferDevice && device) {
+    return {
+      ...device,
+      kind: 'device'
+    };
+  }
+  if (device) {
+    return device;
+  }
+
+  return forms.find((form) => form.kind === 'credentials')
+    || null;
+}
+
+export function parseHtmlForms(html, baseUrl) {
+  const forms = [];
+  const source = String(html || '');
+  const regex = /<form\b([^>]*)>([\s\S]*?)<\/form>/gi;
+  let match;
+  while ((match = regex.exec(source))) {
+    const attrs = match[1];
+    const inner = match[2];
+    const action = resolveActionUrl(decodeHtml(readAttr(attrs, 'action') || ''), baseUrl);
+    const method = (readAttr(attrs, 'method') || 'GET').toUpperCase();
+    const fields = readInputFields(inner);
+    const devices = readDeviceOptions(inner);
+    const kind = classifyForm(fields, devices);
+    forms.push({ action, method, fields, devices, kind });
+  }
+  return forms;
+}
+
+export async function submitCredentialsForm(session, form, { email, password }) {
+  const body = bodyFromForm(form);
+  body.set(usernameFieldName(form) || 'username', email);
+  body.set(passwordFieldName(form) || 'password', password);
+  return postForm(session, form.action, body);
+}
+
+export async function submitPasswordUpdateForm(session, form, {
+  newPassword,
+  confirmPassword
+}) {
+  const fieldNames = passwordUpdateFieldNames(form);
+  if (!fieldNames) {
+    throw safeApiAuthError('Keycloak password update form did not contain the expected password fields.');
+  }
+  if (!newPassword || newPassword !== confirmPassword) {
+    throw safeApiAuthError('New Resource Optimiser passwords must be non-empty and match.');
+  }
+
+  const body = bodyFromForm(form);
+  body.set(fieldNames.newPassword, newPassword);
+  body.set(fieldNames.confirmPassword, confirmPassword);
+  return postForm(session, form.action, body);
+}
+
+export async function submitDeviceForm(session, form, device) {
+  const body = bodyFromForm(form);
+  body.set(device.name, device.value);
+  return postForm(session, form.action, body);
+}
+
+export async function submitOtpForm(session, form, otp, selectedDevice = null) {
+  const body = bodyFromForm(form);
+  if (selectedDevice?.name && selectedDevice.value !== undefined) {
+    body.set(selectedDevice.name, selectedDevice.value);
+  }
+  body.set(otpFieldName(form) || 'otp', otp);
+  return postForm(session, form.action, body);
+}
+
+function postForm(session, action, body) {
+  return session.request(action, {
+    method: 'POST',
+    headers: {
+      Accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
+      'Content-Type': 'application/x-www-form-urlencoded'
+    },
+    body
+  });
+}
+
+export function readTitle(html) {
+  const match = String(html || '').match(/<title[^>]*>([\s\S]*?)<\/title>/i);
+  return match ? stripTags(decodeHtml(match[1])).slice(0, 120) : null;
+}
+
+export function readBodyHint(html) {
+  const bodyMatch = String(html || '').match(/<body[^>]*>([\s\S]*?)<\/body>/i);
+  const body = String(bodyMatch ? bodyMatch[1] : html)
+    .replace(/<script\b[\s\S]*?<\/script>/gi, ' ')
+    .replace(/<style\b[\s\S]*?<\/style>/gi, ' ');
+  const hint = stripTags(decodeHtml(body)).slice(0, 160);
+  return hint || null;
+}
+
+function resolveActionUrl(action, baseUrl) {
+  if (!action) {
+    return baseUrl ? new URL(baseUrl).toString() : '';
+  }
+  if (!baseUrl) {
+    return action;
+  }
+  return new URL(action, baseUrl).toString();
+}
+
+function bodyFromForm(form) {
+  const body = new URLSearchParams();
+  for (const field of form.fields) {
+    if (field.name && field.value !== undefined) {
+      body.set(field.name, field.value);
+    }
+  }
+  return body;
+}
+
+function classifyForm(fields, devices) {
+  if (passwordUpdateFieldNames({ fields })) {
+    return 'password-update';
+  }
+  if (passwordFieldName({ fields })) {
+    return 'credentials';
+  }
+  if (otpFieldName({ fields })) {
+    return 'otp';
+  }
+  if (devices.length > 0) {
+    return 'device';
+  }
+  return 'unknown';
+}
+
+function readInputFields(html) {
+  const fields = [];
+  const regex = /<input\b([^>]*)>/gi;
+  let match;
+  while ((match = regex.exec(String(html || '')))) {
+    const attrs = match[1];
+    fields.push({
+      name: decodeHtml(readAttr(attrs, 'name') || ''),
+      id: decodeHtml(readAttr(attrs, 'id') || ''),
+      type: decodeHtml(readAttr(attrs, 'type') || 'text'),
+      value: decodeHtml(readAttr(attrs, 'value') || ''),
+      autocomplete: decodeHtml(readAttr(attrs, 'autocomplete') || ''),
+      inputmode: decodeHtml(readAttr(attrs, 'inputmode') || ''),
+      placeholder: decodeHtml(readAttr(attrs, 'placeholder') || ''),
+      ariaLabel: decodeHtml(readAttr(attrs, 'aria-label') || '')
+    });
+  }
+  return fields.filter((field) => field.name);
+}
+
+function otpFieldName(form) {
+  return form.fields.find(isOtpInputField)?.name;
+}
+
+function usernameFieldName(form) {
+  return fieldName(form, ['username', 'email', 'login', 'user', 'userid', 'user_id']) ||
+    form.fields.find((field) => isTextInputField(field) && fieldHint(field, /user|email|login|account|identifier/))?.name ||
+    form.fields.find((field) => isTextInputField(field) && !isOtpInputField(field))?.name;
+}
+
+function passwordFieldName(form) {
+  return fieldName(form, ['password', 'passwd', 'pass', 'pwd']) ||
+    form.fields.find((field) => String(field.type || '').toLowerCase() === 'password')?.name;
+}
+
+function passwordUpdateFieldNames(form) {
+  const passwordFields = form.fields.filter(
+    (field) => String(field.type || '').toLowerCase() === 'password'
+  );
+  if (passwordFields.length < 2) {
+    return null;
+  }
+
+  const newPassword = fieldName(form, [
+    'password-new',
+    'new-password',
+    'newPassword',
+    'passwordNew'
+  ]) || passwordFields.find((field) => fieldHint(field, /(?:new.*password|password.*new)/i))?.name;
+  const confirmPassword = fieldName(form, [
+    'password-confirm',
+    'confirm-password',
+    'confirmPassword',
+    'passwordConfirm',
+    'password-repeat',
+    'repeat-password'
+  ]) || passwordFields.find((field) => fieldHint(field, /confirm|repeat/i))?.name;
+
+  if (newPassword && confirmPassword && newPassword !== confirmPassword) {
+    return { newPassword, confirmPassword };
+  }
+
+  return {
+    newPassword: passwordFields[0].name,
+    confirmPassword: passwordFields[1].name
+  };
+}
+
+function fieldName(form, candidates) {
+  const lower = new Set(candidates.map((candidate) => candidate.toLowerCase()));
+  return form.fields.find((field) => lower.has(String(field.name || '').toLowerCase()))?.name;
+}
+
+function isTextInputField(field) {
+  const type = String(field.type || 'text').toLowerCase();
+  return ['text', 'email', 'search', 'tel', 'url', ''].includes(type);
+}
+
+function isOtpInputField(field) {
+  const name = String(field.name || '').toLowerCase();
+  const type = String(field.type || 'text').toLowerCase();
+  if (['hidden', 'radio', 'checkbox', 'submit', 'button'].includes(type)) {
+    return false;
+  }
+
+  if (/^(otp|totp|mfa|mfa_code|two_factor|twofactor|authenticator_code|authenticatorCode)$/i.test(name)) {
+    return true;
+  }
+
+  if (/(otp|totp|mfa|2fa|two[_-]?factor|authenticator|verification)/i.test(name)) {
+    return true;
+  }
+
+  if (name !== 'code') {
+    return false;
+  }
+
+  return fieldHint(field, /otp|totp|one-time|one time|verification|authenticator|2fa|mfa|sms|pin|numeric|number/);
+}
+
+function fieldHint(field, pattern) {
+  const hint = [
+    field.id,
+    field.autocomplete,
+    field.inputmode,
+    field.placeholder,
+    field.ariaLabel
+  ].map((value) => String(value || '').toLowerCase()).join(' ');
+
+  return pattern.test(hint);
+}
+
+function readDeviceOptions(html) {
+  const devices = [];
+  const radioRegex = /<input\b([^>]*type=["']?radio["']?[^>]*)>/gi;
+  let radioMatch;
+  while ((radioMatch = radioRegex.exec(String(html || '')))) {
+    const attrs = radioMatch[1];
+    const name = decodeHtml(readAttr(attrs, 'name') || '');
+    const value = decodeHtml(readAttr(attrs, 'value') || '');
+    const id = decodeHtml(readAttr(attrs, 'id') || '');
+    if (!name || !value) {
+      continue;
+    }
+    devices.push({
+      type: 'radio',
+      name,
+      value,
+      label: readLabelFor(html, id) || readWrappingLabelForInput(html, attrs) || value
+    });
+  }
+
+  const selectRegex = /<select\b([^>]*)>([\s\S]*?)<\/select>/gi;
+  let selectMatch;
+  while ((selectMatch = selectRegex.exec(String(html || '')))) {
+    const name = decodeHtml(readAttr(selectMatch[1], 'name') || '');
+    if (!name) {
+      continue;
+    }
+    const optionRegex = /<option\b([^>]*)>([\s\S]*?)<\/option>/gi;
+    let optionMatch;
+    while ((optionMatch = optionRegex.exec(selectMatch[2]))) {
+      const value = decodeHtml(readAttr(optionMatch[1], 'value') || '');
+      const label = stripTags(decodeHtml(optionMatch[2]));
+      if (value) {
+        devices.push({ type: 'select', name, value, label: label || value });
+      }
+    }
+  }
+
+  return devices;
+}
+
+function readLabelFor(html, id) {
+  if (!id) {
+    return null;
+  }
+  const escapedId = id.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const match = String(html || '').match(new RegExp(`<label\\b[^>]*for=["']${escapedId}["'][^>]*>([\\s\\S]*?)<\\/label>`, 'i'));
+  return match ? stripTags(decodeHtml(match[1])) : null;
+}
+
+function readWrappingLabelForInput(html, inputAttrs) {
+  const inputValue = readAttr(inputAttrs, 'value');
+  const labels = String(html || '').match(/<label\b[^>]*>[\s\S]*?<\/label>/gi) || [];
+  for (const label of labels) {
+    const inputMatch = label.match(/<input\b([^>]*)>/i);
+    if (!inputMatch) {
+      continue;
+    }
+    const labelInputValue = readAttr(inputMatch[1], 'value');
+    const labelInputName = readAttr(inputMatch[1], 'name');
+    if (
+      inputValue !== null &&
+      labelInputValue === inputValue &&
+      labelInputName === readAttr(inputAttrs, 'name')
+    ) {
+      return stripTags(decodeHtml(label));
+    }
+  }
+  return null;
+}
+
+export function summarizeFormShapes(forms) {
+  return forms
+    .slice(0, 3)
+    .map((form, index) => {
+      const fields = form.fields
+        .slice(0, 8)
+        .map((field) => `${field.name || '(unnamed)'}:${field.type || 'text'}`)
+        .join(',');
+      const devices = form.devices.length ? ` devices=${form.devices.length}` : '';
+      return `form${index + 1}{kind=${form.kind || 'unknown'} fields=[${fields}]${devices}}`;
+    })
+    .join(' ');
+}
+
+function readAttr(attrs, name) {
+  const match = String(attrs || '').match(new RegExp(`${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s>]+))`, 'i'));
+  return match?.[1] ?? match?.[2] ?? match?.[3] ?? null;
+}
+
+function findAttributeValue(html, attr, pattern) {
+  const regex = new RegExp(`${attr}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s>]+))`, 'gi');
+  let match;
+  while ((match = regex.exec(String(html || '')))) {
+    const value = match[1] ?? match[2] ?? match[3] ?? '';
+    if (pattern.test(value)) {
+      return value;
+    }
+  }
+  return null;
+}
+
+function decodeHtml(value) {
+  return String(value || '')
+    .replace(/&amp;/g, '&')
+    .replace(/&quot;/g, '"')
+    .replace(/&#39;/g, "'")
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>');
+}
+
+function stripTags(value) {
+  return String(value || '').replace(/<[^>]*>/g, '').replace(/\s+/g, ' ').trim();
+}

package/lib/api-auth-http.mjs

@@ -0,0 +1,184 @@
+// Cookie-carrying HTTP session for the Keycloak login. Redirects are followed by
+// hand so every hop is checked against the allowed origins and the code callback.
+import { CONFIG } from './config.mjs';
+import { fetchWithPolicy } from './http.mjs';
+import {
+  assertSecureUrl,
+  readAuthorizationCode,
+  safeApiAuthError,
+  sameRedirectTarget,
+  stripHash
+} from './api-auth-support.mjs';
+
+export function createHttpSession({
+  fetchImpl = fetch,
+  allowedHosts = [],
+  allowedOrigins = [],
+  authorizationRedirectUri = null
+} = {}) {
+  const jar = new CookieJar();
+
+  return {
+    jar,
+    async request(url, options = {}) {
+      return requestWithRedirects({
+        fetchImpl,
+        jar,
+        url,
+        options,
+        allowedHosts,
+        allowedOrigins,
+        authorizationRedirectUri
+      });
+    }
+  };
+}
+
+export async function requestWithRedirects({
+  fetchImpl,
+  jar,
+  url,
+  options = {},
+  maxRedirects = 10,
+  allowedHosts = [],
+  allowedOrigins = [],
+  authorizationRedirectUri = null,
+  timeoutMs = CONFIG.httpTimeoutMs,
+  retryDelayMs = CONFIG.httpRetryDelayMs,
+  retries = CONFIG.httpReadRetries
+}) {
+  let currentUrl = new URL(url).toString();
+  let method = options.method || 'GET';
+  let body = options.body;
+  const headers = new Headers(options.headers || {});
+  const allowedHostSet = new Set(allowedHosts.filter(Boolean).map((host) => String(host).toLowerCase()));
+  const allowedOriginSet = new Set(allowedOrigins.filter(Boolean).map((origin) => String(origin).toLowerCase()));
+
+  for (let redirectCount = 0; redirectCount <= maxRedirects; redirectCount += 1) {
+    assertSecureUrl(currentUrl, 'Auth request');
+    const cookie = jar.header(currentUrl);
+    if (cookie) {
+      headers.set('Cookie', cookie);
+    }
+    const response = await fetchWithPolicy(currentUrl, {
+      ...options,
+      fetchImpl,
+      timeoutMs,
+      retryDelayMs,
+      retries,
+      idempotent: isIdempotentMethod(method),
+      method,
+      body,
+      headers,
+      redirect: 'manual'
+    });
+    jar.store(currentUrl, response.headers);
+
+    if (isRedirect(response.status)) {
+      const location = response.headers.get('location');
+      if (!location) {
+        throw safeApiAuthError('Redirect response did not include a location header.');
+      }
+      const nextUrl = new URL(location, currentUrl).toString();
+      assertAllowedRedirect(nextUrl, {
+        allowedHosts: allowedHostSet,
+        allowedOrigins: allowedOriginSet,
+        authorizationRedirectUri
+      });
+      const redirectCode = readAuthorizationCode(nextUrl);
+      if (redirectCode) {
+        return {
+          url: nextUrl,
+          status: response.status,
+          headers: response.headers,
+          body: '',
+          redirectCode,
+          redirectUri: stripHash(nextUrl)
+        };
+      }
+      currentUrl = nextUrl;
+      method = 'GET';
+      body = undefined;
+      headers.delete('Content-Type');
+      continue;
+    }
+
+    const text = await response.text();
+    if (!response.ok) {
+      throw safeApiAuthError(`API auth request failed with HTTP ${response.status}.`);
+    }
+    return {
+      url: currentUrl,
+      status: response.status,
+      headers: response.headers,
+      body: text
+    };
+  }
+
+  throw safeApiAuthError('Too many redirects during API auth.');
+}
+
+function assertAllowedRedirect(rawUrl, { allowedHosts, allowedOrigins, authorizationRedirectUri }) {
+  const url = assertSecureUrl(rawUrl, 'Auth redirect');
+  const origin = url.origin.toLowerCase();
+  const host = url.host.toLowerCase();
+  const originAllowed = allowedOrigins?.size
+    ? allowedOrigins.has(origin)
+    : allowedHosts.has(host);
+  if (!originAllowed) {
+    throw safeApiAuthError(`Blocked auth redirect to unexpected origin: ${url.origin || 'unknown-origin'}.`);
+  }
+
+  if (readAuthorizationCode(rawUrl) && !sameRedirectTarget(rawUrl, authorizationRedirectUri)) {
+    throw safeApiAuthError('Blocked authorization code redirect to unexpected Resource Optimiser callback.');
+  }
+}
+
+function isRedirect(status) {
+  return [301, 302, 303, 307, 308].includes(status);
+}
+
+function isIdempotentMethod(method) {
+  return ['GET', 'HEAD', 'OPTIONS'].includes(String(method || 'GET').toUpperCase());
+}
+
+class CookieJar {
+  constructor() {
+    this.cookies = new Map();
+  }
+
+  store(rawUrl, headers) {
+    const url = new URL(rawUrl);
+    const values = getSetCookieValues(headers);
+    for (const value of values) {
+      const [pair] = value.split(';');
+      const [name, cookieValue] = pair.split('=');
+      if (name && cookieValue !== undefined) {
+        this.cookies.set(`${url.hostname}:${name.trim()}`, `${name.trim()}=${cookieValue.trim()}`);
+      }
+    }
+  }
+
+  header(rawUrl) {
+    const url = new URL(rawUrl);
+    return [...this.cookies.entries()]
+      .filter(([key]) => key.startsWith(`${url.hostname}:`))
+      .map(([, value]) => value)
+      .join('; ');
+  }
+}
+
+function getSetCookieValues(headers) {
+  if (typeof headers.getSetCookie === 'function') {
+    return headers.getSetCookie();
+  }
+  const value = headers.get?.('set-cookie');
+  return value ? splitSetCookie(value) : [];
+}
+
+function splitSetCookie(value) {
+  return String(value)
+    .split(/,(?=\s*[^;,\s]+=)/)
+    .map((item) => item.trim())
+    .filter(Boolean);
+}

package/lib/api-auth-support.mjs

@@ -0,0 +1,101 @@
+// Shared helpers for the API-only Keycloak login: safe errors, URL and origin
+// checks, authorization-response URL readers and best-effort auth diagnostics.
+import { redactText } from './auth-redaction.mjs';
+
+export function assertSecureUrl(rawUrl, label) {
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    throw safeApiAuthError(`${label} must be a valid URL.`);
+  }
+
+  if (!['http:', 'https:'].includes(url.protocol)) {
+    throw safeApiAuthError(`${label} must use HTTP or HTTPS.`);
+  }
+
+  if (url.protocol === 'http:' && !isLocalHttpHost(url.hostname)) {
+    throw safeApiAuthError(`${label} must use HTTPS unless it points to localhost or loopback.`);
+  }
+
+  return url;
+}
+
+export function originFromUrl(rawUrl) {
+  return assertSecureUrl(rawUrl, 'Origin URL').origin;
+}
+
+export function recordAuthEvent(recorder, name, details = {}) {
+  try {
+    recorder?.event?.(name, details);
+  } catch {
+    // Diagnostics must never break auth.
+  }
+}
+
+export function safeUrlParts(rawUrl) {
+  try {
+    const url = new URL(rawUrl);
+    return {
+      host: url.host,
+      path: url.pathname
+    };
+  } catch {
+    return {
+      host: 'unknown-host',
+      path: '/unknown-path'
+    };
+  }
+}
+
+export function readAuthorizationCode(rawUrl) {
+  const url = new URL(rawUrl);
+  return url.searchParams.get('code') || new URLSearchParams(url.hash.replace(/^#/, '')).get('code');
+}
+
+export function readAuthorizationState(rawUrl) {
+  const url = new URL(rawUrl);
+  return url.searchParams.get('state') || new URLSearchParams(url.hash.replace(/^#/, '')).get('state');
+}
+
+export function sameRedirectTarget(rawUrl, expectedRawUrl) {
+  if (!expectedRawUrl) {
+    return false;
+  }
+
+  try {
+    const url = new URL(rawUrl);
+    const expected = new URL(expectedRawUrl);
+    return url.origin === expected.origin && url.pathname === expected.pathname;
+  } catch {
+    return false;
+  }
+}
+
+function isLocalHttpHost(hostname) {
+  const host = String(hostname || '').replace(/^\[|\]$/g, '').toLowerCase();
+  return host === 'localhost' ||
+    host === '127.0.0.1' ||
+    host === '::1' ||
+    host.startsWith('127.');
+}
+
+export function stripHash(rawUrl) {
+  const url = new URL(rawUrl);
+  url.hash = '';
+  return url.toString();
+}
+
+export function safeJson(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw safeApiAuthError('Auth endpoint returned non-JSON response.');
+  }
+}
+
+export function safeApiAuthError(message) {
+  const error = new Error(redactText(message));
+  error.code = 'API_AUTH_FAILED';
+  return error;
+}