metergraph-cli 0.1.0 → 0.2.0-preview.0

package/src/auth-browser.js

@@ -0,0 +1,74 @@
+import childProcess from "node:child_process";
+import path from "node:path";
+
+// Opens a URL with the operating system's own launcher: a fixed executable
+// and an argument array, never a shell. The URL is the authorization request
+// (public client ID, state and PKCE challenge); no token, code or verifier is
+// ever on a command line. Resolves true when the launcher started, false
+// when it could not be started. A started launcher does not prove that a
+// browser opened, so callers still wait for the callback with a deadline.
+export function openBrowser(url) {
+  const { command, args } = launcher();
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = childProcess.spawn(command, [...args, url], {
+        shell: false,
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true,
+      });
+    } catch {
+      resolve(false);
+      return;
+    }
+    child.once("error", () => resolve(false));
+    child.once("spawn", () => {
+      child.unref();
+      resolve(true);
+    });
+  });
+}
+
+function launcher() {
+  if (process.platform === "darwin") return { command: "/usr/bin/open", args: [] };
+  if (process.platform === "win32") {
+    return {
+      command: path.win32.join(systemRoot(), "System32", "rundll32.exe"),
+      args: ["url.dll,FileProtocolHandler"],
+    };
+  }
+  return { command: "/usr/bin/xdg-open", args: [] };
+}
+
+// The Windows directory, from SystemRoot only when it is a plain absolute
+// drive path, otherwise the standard location.
+export function systemRoot() {
+  const value = process.env.SystemRoot;
+  if (typeof value === "string" && /^[A-Za-z]:\\[A-Za-z0-9 ._\\-]*$/.test(value) && !value.includes("..")) {
+    return value;
+  }
+  return "C:\\Windows";
+}
+
+// Variables whose presence means the browser a person uses is not on this
+// machine, or no person is present. Only presence is checked; values are
+// never read into output.
+const REMOTE_MARKERS = [
+  ["ssh_session", ["SSH_CONNECTION", "SSH_CLIENT", "SSH_TTY"]],
+  ["cloud_workspace", ["CODESPACES", "GITPOD_WORKSPACE_ID", "CLOUD_SHELL"]],
+  ["ci_environment", ["CI"]],
+];
+
+// Returns null for an ordinary local session, or a fixed reason token.
+export function detectRemoteSession(env = process.env) {
+  for (const [reason, names] of REMOTE_MARKERS) {
+    for (const name of names) {
+      const value = env[name];
+      if (typeof value === "string" && value !== "" && value !== "0" && value.toLowerCase() !== "false") {
+        return reason;
+      }
+    }
+  }
+  return null;
+}

package/src/auth-callback.js

@@ -0,0 +1,177 @@
+import { timingSafeEqual } from "node:crypto";
+import http from "node:http";
+
+// Loopback listener for the OAuth redirect (RFC 8252 section 7.3). It binds
+// 127.0.0.1 on an ephemeral port and accepts exactly one callback: a GET on
+// the fixed path, with the exact Host, one state that matches, and either one
+// code or one error. Anything else is answered with a fixed page and the
+// listener keeps waiting, so a stray or forged request cannot end the flow.
+// Pages are static: no code, state or other request value is reflected, and
+// nothing about a request is logged.
+
+export const CALLBACK_PATH = "/callback";
+const HOST = "127.0.0.1";
+const MAX_URL_LENGTH = 4096;
+const MAX_CODE_LENGTH = 2048;
+const ALLOWED_PARAMS = new Set(["code", "state", "error", "error_description", "error_uri", "iss"]);
+
+const PAGE_HEADERS = {
+  "content-type": "text/html; charset=utf-8",
+  "cache-control": "no-store",
+  "content-security-policy": "default-src 'none'",
+  "referrer-policy": "no-referrer",
+  "x-content-type-options": "nosniff",
+  "x-frame-options": "DENY",
+  connection: "close",
+};
+const page = (text) =>
+  `<!doctype html><meta charset="utf-8"><title>Metergraph CLI</title><p>${text}</p>\n`;
+const PAGES = {
+  done: page("Metergraph CLI: authorization received. You can close this tab and return to the terminal."),
+  failed: page("Metergraph CLI: authorization did not complete. Return to the terminal for details."),
+  invalid: page("Metergraph CLI: this request was not accepted."),
+};
+
+// Starts listening. Resolves with { redirectUri, wait, close }.
+//   wait({ state, issuer, requireIss, timeoutMs, cancel }) arms the listener
+//     synchronously: from the moment it returns, a matching callback is
+//     accepted and the timeout is running. Call it before the authorization
+//     URL is opened or printed, so a fast browser can never reach an unarmed
+//     listener. It may be called once. The promise resolves with
+//     { kind: "code", code }
+//     { kind: "denied" }                  the user or server declined
+//     { kind: "error", reason }           authorization_error,
+//                                         callback_issuer_mismatch or
+//                                         callback_invalid
+//     { kind: "timeout" } or { kind: "cancelled" }
+//   close() stops the listener, destroys every socket and settles a pending
+//   wait as cancelled, clearing its timer. It is safe to call more than once
+//   and must be called on every outcome, including early returns.
+export async function startCallbackListener() {
+  const sockets = new Set();
+  let handler = (request, response) => respond(response, 503, PAGES.invalid);
+  const server = http.createServer(
+    { maxHeaderSize: 8192, requestTimeout: 10000, headersTimeout: 10000 },
+    (request, response) => handler(request, response),
+  );
+  server.on("connection", (socket) => {
+    sockets.add(socket);
+    socket.on("close", () => sockets.delete(socket));
+  });
+  server.on("clientError", (error, socket) => socket.destroy());
+
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, HOST, () => {
+      server.removeListener("error", reject);
+      resolve();
+    });
+  });
+  const { port } = server.address();
+  const host = `${HOST}:${port}`;
+  const redirectUri = `http://${host}${CALLBACK_PATH}`;
+
+  let closed = false;
+  let armed = false;
+  // Settles the pending wait, if any. Replaced when wait() arms.
+  let settlePending = () => {};
+
+  const close = async () => {
+    settlePending({ kind: "cancelled" });
+    if (closed) return;
+    closed = true;
+    const done = new Promise((resolve) => server.close(() => resolve()));
+    for (const socket of sockets) socket.destroy();
+    await done;
+  };
+
+  const wait = ({ state, issuer, requireIss, timeoutMs, cancel }) => {
+    if (armed) throw new Error("callback listener is already armed");
+    armed = true;
+    // The executor runs synchronously, so the handler and timer are in
+    // place before wait() returns.
+    return new Promise((resolve) => {
+      let settled = false;
+      let timer = null;
+      const finish = (result) => {
+        if (settled) return;
+        settled = true;
+        if (timer !== null) clearTimeout(timer);
+        cancel?.removeEventListener("abort", onCancel);
+        resolve(result);
+      };
+      const onCancel = () => finish({ kind: "cancelled" });
+      settlePending = finish;
+
+      handler = (request, response) => {
+        if (settled) return respond(response, 410, PAGES.invalid);
+        const verdict = inspect(request, { host, state, issuer, requireIss });
+        if (verdict.result === undefined) return respond(response, verdict.status, PAGES.invalid);
+        const result = verdict.result;
+        respond(response, verdict.status, result.kind === "code" ? PAGES.done : PAGES.failed);
+        finish(result);
+      };
+
+      if (closed || cancel?.aborted) {
+        onCancel();
+        return;
+      }
+      timer = setTimeout(() => finish({ kind: "timeout" }), timeoutMs);
+      cancel?.addEventListener("abort", onCancel, { once: true });
+    });
+  };
+
+  return { redirectUri, wait, close };
+}
+
+function respond(response, status, body) {
+  response.writeHead(status, { ...PAGE_HEADERS, "content-length": Buffer.byteLength(body) });
+  response.end(body);
+}
+
+// Returns { status } for a request that is ignored, or { status, result }
+// for the one request that ends the flow.
+function inspect(request, { host, state, issuer, requireIss }) {
+  const url = request.url ?? "";
+  if (url.length > MAX_URL_LENGTH) return { status: 414 };
+  if (request.method !== "GET") return { status: 405 };
+  if (request.headers.host !== host) return { status: 400 };
+  const mark = url.indexOf("?");
+  const pathname = mark === -1 ? url : url.slice(0, mark);
+  if (pathname !== CALLBACK_PATH) return { status: 404 };
+
+  let params;
+  try {
+    params = new URLSearchParams(mark === -1 ? "" : url.slice(mark + 1));
+  } catch {
+    return { status: 400 };
+  }
+  const seen = new Set();
+  for (const key of params.keys()) {
+    if (!ALLOWED_PARAMS.has(key) || seen.has(key)) return { status: 400 };
+    seen.add(key);
+  }
+  // Only a request that carries this flow's exact state can end it.
+  if (!seen.has("state") || !sameText(params.get("state"), state)) return { status: 400 };
+
+  if (seen.has("iss") ? params.get("iss") !== issuer : requireIss) {
+    return { status: 400, result: { kind: "error", reason: "callback_issuer_mismatch" } };
+  }
+  if (seen.has("error")) {
+    if (seen.has("code")) return { status: 400, result: { kind: "error", reason: "callback_invalid" } };
+    return params.get("error") === "access_denied"
+      ? { status: 200, result: { kind: "denied" } }
+      : { status: 200, result: { kind: "error", reason: "authorization_error" } };
+  }
+  const code = params.get("code");
+  if (code === null || code.length === 0 || code.length > MAX_CODE_LENGTH || /[^\x21-\x7e]/.test(code)) {
+    return { status: 400, result: { kind: "error", reason: "callback_invalid" } };
+  }
+  return { status: 200, result: { kind: "code", code } };
+}
+
+function sameText(actual, expected) {
+  const a = Buffer.from(actual);
+  const b = Buffer.from(expected);
+  return a.length === b.length && timingSafeEqual(a, b);
+}

package/src/auth-login.js

@@ -0,0 +1,410 @@
+import { detectRemoteSession, openBrowser } from "./auth-browser.js";
+import { startCallbackListener } from "./auth-callback.js";
+import {
+  BINDING_PATH,
+  bindingFor,
+  readBinding,
+  removeBinding,
+  resolveProject,
+  writeBinding,
+} from "./auth-binding.js";
+import {
+  authorizationUrl,
+  discover,
+  endpointsFor,
+  exchangeCode,
+  newPkce,
+  register,
+  revoke,
+  verifyContext,
+} from "./auth-oauth.js";
+import { LOCK_WAIT_MS, sessionFor } from "./auth-session.js";
+import {
+  PROTECTION,
+  Stop,
+  deleteCredential,
+  newSlot,
+  openStore,
+  readCredential,
+  resolveConfigDir,
+  withSlotLock,
+  writeCredential,
+} from "./auth-store.js";
+import { AUTH_HTTP_TIMEOUT_MS, CONNECTION_GUIDE_URL, METADATA_SCOPE } from "./constants.js";
+import { runDoctor } from "./doctor.js";
+import { deadline, trapSignals } from "./transport.js";
+
+// login and logout. Each returns { outcome, reason, data }; every string in
+// data is a fixed token, the validated origin, a supported profile or a
+// server-verified workspace UUID. Token values, the authorization code, the
+// PKCE verifier, absolute paths and server text never leave this module.
+// progress(text) prints human progress lines; it is a no-op with --json.
+
+export async function runLogin(options, progress) {
+  const ctx = {
+    origin: options.origin,
+    runtime: options.runtime,
+    profile: null,
+    workspaceId: null,
+    authenticated: false,
+    configured: false,
+    status: null,
+    previousGrant: null,
+  };
+  const end = (outcome, reason, next = null) => ({ outcome, reason, data: loginData(ctx, next) });
+
+  // Handoffs come first: no listener, request or file write happens for a
+  // session that cannot finish sign in.
+  if (options.runtime !== "local") return end("unsupported", "runtime_not_supported", GUIDE);
+  const remote = detectRemoteSession();
+  if (remote !== null) return end("unsupported", remote, GUIDE);
+  if (options.json && options.noBrowser) {
+    return end("unsupported", "no_browser_requires_terminal", {
+      kind: "run_in_terminal",
+      message: "Run the same login command in a terminal without --json to see the sign in URL.",
+    });
+  }
+
+  const trap = trapSignals();
+  try {
+    const root = resolveProject(options.project);
+    const configDir = resolveConfigDir(options.configDir);
+    const existing = readBinding(root);
+    const bound = existing?.binding ?? null;
+    // Setup pins a deployment model before sign in. A stale binding for a
+    // different profile must never be silently reused or reconnected.
+    if (options.expectedProfile && bound !== null && !options.reconnect &&
+        bound.deployment_profile !== options.expectedProfile) {
+      return end("conflict", "deployment_profile_mismatch");
+    }
+    if (bound !== null && !options.reconnect) {
+      if (bound.origin !== options.origin) return end("conflict", "bound_to_other_origin", RECONNECT);
+      if (options.workspace !== null && options.workspace !== bound.workspace_id) {
+        return end("conflict", "bound_to_other_workspace", RECONNECT);
+      }
+    }
+    const store = openStore(configDir, { create: true });
+
+    // A rerun with a working grant changes nothing and opens no browser.
+    if (bound !== null && !options.reconnect) {
+      const session = await sessionFor(bound, store, trap.signal);
+      if (session.ok) {
+        Object.assign(ctx, {
+          profile: bound.deployment_profile,
+          workspaceId: bound.workspace_id,
+          authenticated: true,
+          configured: true,
+          status: "reused",
+        });
+        return end("ok", null, CONNECTED);
+      }
+      if (session.outcome !== "login_required") return end(session.outcome, session.reason);
+    }
+
+    const flow = await authorize(options, ctx, trap.signal, progress);
+    if (!flow.ok) return end(flow.outcome, flow.reason, flow.next ?? null);
+    const { endpoints, clientId, grant } = flow;
+
+    // The browser chose the workspace. Bind only one that matches what
+    // this project is already bound to, unless the user asked to switch.
+    if (bound !== null && !options.reconnect && grant.tenant !== bound.workspace_id) {
+      await revokeQuietly(endpoints, clientId, grant.refreshToken);
+      return end("conflict", "bound_to_other_workspace", RECONNECT);
+    }
+
+    const slot = newSlot();
+    try {
+      writeCredential(store, slot, {
+        schema_version: 1,
+        origin: ctx.origin,
+        issuer: endpoints.issuer,
+        resource: endpoints.resource,
+        deployment_profile: ctx.profile,
+        workspace_id: grant.tenant,
+        client_id: clientId,
+        scope: METADATA_SCOPE,
+        access_token: grant.accessToken,
+        refresh_token: grant.refreshToken,
+        expires_at: grant.expiresAt,
+        refresh_pending: false,
+      });
+    } catch (error) {
+      await revokeQuietly(endpoints, clientId, grant.refreshToken);
+      throw error;
+    }
+    try {
+      writeBinding(root, bindingFor({ origin: ctx.origin, workspaceId: grant.tenant, profile: ctx.profile, slot }), existing);
+    } catch (error) {
+      let cleaned = true;
+      try {
+        deleteCredential(store, slot);
+      } catch {
+        cleaned = false;
+      }
+      await revokeQuietly(endpoints, clientId, grant.refreshToken);
+      if (!cleaned) return end("filesystem_error", "binding_partial_write");
+      throw error;
+    }
+    Object.assign(ctx, { authenticated: true, configured: true, status: bound === null ? "signed_in" : "reconnected" });
+
+    // The old grant is no longer referenced. Ask the service to revoke it
+    // and remove it locally; neither affects the new binding.
+    if (bound !== null && bound.credential_slot !== slot) {
+      ctx.previousGrant = await retireSlot(store, bound);
+    }
+    return end("ok", null, CONNECTED);
+  } catch (error) {
+    if (error instanceof Stop) return end(error.outcome, error.reason);
+    throw error;
+  } finally {
+    trap.release();
+  }
+}
+
+// Preflight, discovery, registration, the browser round trip, the code
+// exchange and server-side verification. Nothing is written here. A validated
+// grant that is not accepted is sent for revocation before returning; that is
+// best effort, and a token response that fails validation cannot be revoked.
+async function authorize(options, ctx, cancel, progress) {
+  const preflight = await runDoctor({ origin: ctx.origin, timeoutMs: AUTH_HTTP_TIMEOUT_MS });
+  if (cancel.aborted) return fail("authorization_failed", "cancelled");
+  if (preflight.outcome !== "authentication_required") return fail(preflight.outcome, preflight.reason);
+  ctx.profile = preflight.report.deployment_profile;
+  if (options.expectedProfile && ctx.profile !== options.expectedProfile) {
+    return fail("unsupported", "deployment_profile_mismatch");
+  }
+  if (options.signup && ctx.profile !== "managed") return fail("unsupported", "signup_unsupported");
+
+  let limit = deadline(AUTH_HTTP_TIMEOUT_MS, cancel);
+  const discovered = await discover(ctx.origin, limit.signal);
+  if (!discovered.ok) return httpFailure(discovered, cancel);
+  const { endpoints, requireIss } = discovered;
+
+  const listener = await startCallbackListener();
+  let callback;
+  let clientId;
+  let verifier;
+  try {
+    limit = deadline(AUTH_HTTP_TIMEOUT_MS, cancel);
+    const registered = await register(endpoints, listener.redirectUri, limit.signal);
+    if (!registered.ok) return httpFailure(registered, cancel);
+    clientId = registered.clientId;
+
+    const pkce = newPkce();
+    verifier = pkce.verifier;
+    // Arm the exact state, Host and path check and start the timeout before
+    // the URL exists anywhere outside this process. Every return below
+    // reaches the finally, whose close() settles this wait and clears its
+    // timer.
+    const pending = listener.wait({
+      state: pkce.state,
+      issuer: endpoints.issuer,
+      requireIss,
+      timeoutMs: options.timeoutMs,
+      cancel,
+    });
+    const url = authorizationUrl(endpoints, {
+      clientId,
+      redirectUri: listener.redirectUri,
+      state: pkce.state,
+      challenge: pkce.challenge,
+      signup: options.signup,
+    });
+    const seconds = Math.round(options.timeoutMs / 1000);
+    // A wait armed after Ctrl+C has already settled; do not show the URL.
+    if (cancel.aborted) return fail("authorization_failed", "cancelled");
+    if (options.noBrowser) {
+      progress(
+        "Open this URL in a browser on this machine to sign in:\n" +
+          `${url}\n` +
+          `Waiting up to ${seconds} seconds for the browser. Press Ctrl+C to cancel.`,
+      );
+    } else {
+      if (!(await openBrowser(url))) {
+        return fail("authorization_failed", "browser_unavailable", {
+          kind: "no_browser",
+          message: "Run login again with --no-browser, without --json, and open the URL it prints.",
+        });
+      }
+      progress(`Opened your browser to sign in. Waiting up to ${seconds} seconds. Press Ctrl+C to cancel.`);
+    }
+    callback = await pending;
+  } finally {
+    await listener.close();
+  }
+
+  if (callback.kind === "denied") return fail("authorization_failed", "access_denied");
+  if (callback.kind === "timeout") return fail("authorization_failed", "timeout");
+  if (callback.kind === "cancelled") return fail("authorization_failed", "cancelled");
+  if (callback.kind !== "code") return fail("authorization_failed", callback.reason);
+
+  limit = deadline(AUTH_HTTP_TIMEOUT_MS, cancel);
+  const exchanged = await exchangeCode(
+    endpoints,
+    { clientId, redirectUri: listener.redirectUri, code: callback.code, verifier },
+    limit.signal,
+  );
+  if (!exchanged.ok) return httpFailure(exchanged, cancel);
+  const { grant } = exchanged;
+
+  const rejectGrant = async (outcome, reason) => {
+    await revokeQuietly(endpoints, clientId, grant.refreshToken);
+    return fail(outcome, reason);
+  };
+  if (options.workspace !== null && grant.tenant !== options.workspace) {
+    return rejectGrant("verification_failed", "workspace_mismatch");
+  }
+  limit = deadline(AUTH_HTTP_TIMEOUT_MS, cancel);
+  const verified = await verifyContext(
+    ctx.origin,
+    grant.accessToken,
+    { profile: ctx.profile, workspaceId: grant.tenant },
+    limit.signal,
+  );
+  if (!verified.ok) {
+    if (cancel.aborted) return rejectGrant("authorization_failed", "cancelled");
+    return rejectGrant(verified.outcome, verified.reason);
+  }
+  ctx.workspaceId = grant.tenant;
+  return { ok: true, endpoints, clientId, grant };
+}
+
+export async function runLogout(options) {
+  const ctx = { origin: null, workspaceId: null, credentials: "none", binding: "none", revocation: "not_attempted" };
+  const end = (outcome, reason) => ({ outcome, reason, data: logoutData(ctx) });
+  const trap = trapSignals();
+  try {
+    const root = resolveProject(options.project);
+    const store = openStore(resolveConfigDir(options.configDir), { create: false });
+    const existing = readBinding(root);
+    if (existing === null) return end("ok", null);
+    const bound = existing.binding;
+    ctx.origin = bound.origin;
+    ctx.workspaceId = bound.workspace_id;
+    ctx.binding = "kept";
+
+    if (store !== null) {
+      const result = await withSlotLock(
+        store,
+        bound.credential_slot,
+        async () => {
+          const record = readOrNull(store, bound.credential_slot);
+          // A grant is only ever sent back to the origin it came from.
+          if (record !== null && record.origin === bound.origin) {
+            const limit = deadline(AUTH_HTTP_TIMEOUT_MS, trap.signal);
+            const discovered = await discover(bound.origin, limit.signal);
+            ctx.revocation = discovered.ok
+              ? await revoke(discovered.endpoints, { clientId: record.client_id, refreshToken: record.refresh_token }, limit.signal)
+              : "unconfirmed";
+          }
+          return deleteCredential(store, bound.credential_slot);
+        },
+        { waitMs: LOCK_WAIT_MS },
+      );
+      if (result) ctx.credentials = "removed";
+    }
+    try {
+      removeBinding(root, existing);
+    } catch (error) {
+      // The grant is already gone; say so instead of the generic write error.
+      if (error instanceof Stop && error.outcome === "filesystem_error") {
+        return end("filesystem_error", "binding_remove_failed");
+      }
+      throw error;
+    }
+    ctx.binding = "removed";
+    return ctx.revocation === "unconfirmed" ? end("revocation_unconfirmed", "revocation_unconfirmed") : end("ok", null);
+  } catch (error) {
+    if (error instanceof Stop) return end(error.outcome, error.reason);
+    throw error;
+  } finally {
+    trap.release();
+  }
+}
+
+// Revokes and removes the grant a previous binding pointed to. Returns
+// "accepted", "unconfirmed" or "not_attempted". Failures here never undo the
+// new binding.
+async function retireSlot(store, bound) {
+  try {
+    return await withSlotLock(
+      store,
+      bound.credential_slot,
+      async () => {
+        const record = readOrNull(store, bound.credential_slot);
+        let revocation = "not_attempted";
+        if (record !== null && record.origin === bound.origin) {
+          revocation = await revokeQuietly(endpointsFor(record.origin), record.client_id, record.refresh_token);
+        }
+        deleteCredential(store, bound.credential_slot);
+        return revocation;
+      },
+      { waitMs: LOCK_WAIT_MS },
+    );
+  } catch {
+    return "unconfirmed";
+  }
+}
+
+function readOrNull(store, slot) {
+  try {
+    return readCredential(store, slot);
+  } catch (error) {
+    if (error instanceof Stop && error.outcome === "login_required") return null;
+    throw error;
+  }
+}
+
+// Revocation with its own deadline, not tied to cancellation, so a grant the
+// CLI decided not to keep is still revoked after Ctrl+C.
+async function revokeQuietly(endpoints, clientId, refreshToken) {
+  const limit = deadline(AUTH_HTTP_TIMEOUT_MS);
+  return revoke(endpoints, { clientId, refreshToken }, limit.signal);
+}
+
+function httpFailure(result, cancel) {
+  if (cancel.aborted) return fail("authorization_failed", "cancelled");
+  return fail(result.outcome, result.reason);
+}
+
+function fail(outcome, reason, next = null) {
+  return { ok: false, outcome, reason, next };
+}
+
+const GUIDE = { kind: "connection_guide", url: CONNECTION_GUIDE_URL };
+const RECONNECT = {
+  kind: "reconnect",
+  message: "Run login again with --reconnect to switch this project, or run logout first.",
+};
+const CONNECTED = {
+  kind: "connected",
+  message: 'This project is signed in with Metadata access. Run "metergraph logout" to sign out.',
+};
+
+function loginData(ctx, next) {
+  return {
+    origin: ctx.origin,
+    runtime: ctx.runtime,
+    deployment_profile: ctx.profile,
+    workspace: ctx.workspaceId === null ? null : { id: ctx.workspaceId },
+    scopes: ctx.authenticated ? [METADATA_SCOPE] : [],
+    authenticated: ctx.authenticated,
+    configured: ctx.configured,
+    status: ctx.status,
+    binding: ctx.configured ? BINDING_PATH : null,
+    credential_protection: ctx.configured ? PROTECTION : null,
+    previous_grant_revocation: ctx.previousGrant,
+    next_action: next,
+  };
+}
+
+function logoutData(ctx) {
+  return {
+    origin: ctx.origin,
+    workspace: ctx.workspaceId === null ? null : { id: ctx.workspaceId },
+    local_credentials: ctx.credentials,
+    binding: ctx.binding,
+    revocation: ctx.revocation,
+    authenticated: false,
+  };
+}