modelos-secure 0.1.0 → 0.1.1

package/README.md

@@ -29,6 +29,8 @@ npx modelos-secure login --url <address> --client-id <client ID> --client-secret
 
 Paste the workspace token when it asks. The token is never typed on the command line. Your browser then opens for you to sign in with Google. The address, the token and the Google sign-in are kept in `~/.modelos-secure/credentials.json`, readable only by you, and the sign-in is renewed as it runs out. Without `--client-id`, as on a local stack, there is no Google sign-in.
 
+When the app is reached at an IP address and its certificate is issued for a name, the login command also has `--tls-name` and that name. The CLI then connects to the address and checks the certificate against the name: its chain, its dates and the name are all still checked. `MODELOS_SECURE_TLS_NAME` does the same for one run. When something cannot be reached, the CLI says why in plain words.
+
 `MODELOS_SECURE_URL` and `MODELOS_SECURE_TOKEN` take the place of the saved address and token. `modelos-secure doctor` says who is signed in to Google, and why a request was turned away.
 
 ## In CI

package/assets/login-BcHFyX6z.js

@@ -0,0 +1 @@
+export { t as loginCommand } from "./login-WwE-Gunj.js";

package/assets/{login-B21lxf7i.js → login-WwE-Gunj.js}

@@ -5,6 +5,8 @@ import { execFile, spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 import { emitKeypressEvents } from "node:readline";
+import { request } from "node:https";
+import { checkServerIdentity } from "node:tls";
 // src/ui.ts
 var color = process.stdout.isTTY && !process.env.NO_COLOR;
 var unicode = process.env.TERM !== "dumb" && !process.env.MODELOS_SECURE_ASCII;
@@ -276,6 +278,61 @@ function gcloudIdentityToken(audience) {
 		});
 	});
 }
+// src/tls.ts
+/** A fetch that connects to the URL's host and checks its certificate against `name`. */
+function fetchCheckingName(name) {
+	return (url, init = {}) => new Promise((resolve, reject) => {
+		const outgoing = request(new URL(url), {
+			method: init.method ?? "GET",
+			headers: init.headers,
+			servername: name,
+			checkServerIdentity: (_host, certificate) => checkServerIdentity(name, certificate),
+			signal: init.signal
+		}, (incoming) => {
+			const chunks = [];
+			incoming.on("data", (chunk) => chunks.push(chunk));
+			incoming.on("error", reject);
+			incoming.on("end", () => {
+				const headers = new Headers();
+				for (const [key, value] of Object.entries(incoming.headers)) if (value !== void 0) headers.set(key, Array.isArray(value) ? value.join(", ") : value);
+				const status = incoming.statusCode ?? 502;
+				resolve(new Response(status === 204 || status === 304 ? null : Buffer.concat(chunks), {
+					status,
+					headers
+				}));
+			});
+		});
+		outgoing.on("error", reject);
+		if (init.body !== void 0) outgoing.write(init.body);
+		outgoing.end();
+	});
+}
+/** What went wrong reaching an address, in plain words, from the error Node gave. */
+function networkMessage(error, url, tlsName) {
+	const cause = error?.cause;
+	const code = (typeof cause?.code === "string" ? cause.code : void 0) ?? error?.code;
+	let host = url;
+	try {
+		host = new URL(url).hostname;
+	} catch {}
+	switch (code) {
+		case "ERR_TLS_CERT_ALTNAME_INVALID": return tlsName ? `The certificate at ${host} is not issued for ${tlsName}. Copy the login command from the tokens page again.` : `The certificate at ${host} is not issued for that address. If it is issued for a name, such as one in your company's domain, log in again with --tls-name and that name.`;
+		case "DEPTH_ZERO_SELF_SIGNED_CERT":
+		case "SELF_SIGNED_CERT_IN_CHAIN":
+		case "UNABLE_TO_VERIFY_LEAF_SIGNATURE":
+		case "UNABLE_TO_GET_ISSUER_CERT_LOCALLY": return `This machine does not trust the certificate at ${host}. If your company adds its own certificates to this machine, set NODE_OPTIONS=--use-system-ca and try again.`;
+		case "CERT_HAS_EXPIRED": return `The certificate at ${host} has expired. Tell whoever runs that address.`;
+		case "ENOTFOUND":
+		case "EAI_AGAIN": return `${host} cannot be found from this machine. Check the address.`;
+		case "ECONNREFUSED":
+		case "ECONNRESET":
+		case "ETIMEDOUT":
+		case "EHOSTUNREACH":
+		case "ENETUNREACH":
+		case "UND_ERR_CONNECT_TIMEOUT": return `${host} cannot be reached from this machine. It may only be reachable on the company network.`;
+		default: return `The request to ${host} failed${code ? ` (${code})` : ""}.`;
+	}
+}
 // src/iap.ts
 /**
 * The Google credential for one connection, in this order: MODELOS_SECURE_IAP_TOKEN as it is;
@@ -390,14 +447,14 @@ async function readConnection() {
 	const url = process.env.MODELOS_SECURE_URL ?? saved?.url;
 	const token = process.env.MODELOS_SECURE_TOKEN ?? saved?.token;
 	if (!url || !token) return null;
-	const google = saved?.google && saved.url && trim(saved.url) === trim(url) ? saved.google : void 0;
-	return google ? {
+	const same = Boolean(saved?.url && trim(saved.url) === trim(url));
+	const google = same ? saved?.google : void 0;
+	const tlsName = process.env.MODELOS_SECURE_TLS_NAME ?? (same ? saved?.tlsName : void 0);
+	return {
 		url: trim(url),
 		token,
-		google
-	} : {
-		url: trim(url),
-		token
+		...google ? { google } : {},
+		...tlsName ? { tlsName } : {}
 	};
 }
 /** The same connection at another address. The Google sign-in goes only to the same origin. */
@@ -431,7 +488,8 @@ async function saveRenewed(url, google) {
 	if (saved?.url && saved.token && trim(saved.url) === url && saved.google?.clientId === google.clientId) await saveConnection({
 		url: saved.url,
 		token: saved.token,
-		google
+		google,
+		...saved.tlsName ? { tlsName: saved.tlsName } : {}
 	});
 }
 var ApiError = class extends Error {
@@ -468,16 +526,26 @@ function apiClient(connection, options = {}) {
 	};
 	const call = async (method, path, body, signal) => {
 		const sent = await credential();
-		const response = await fetch(`${connection.url}/api/v1${path}`, {
+		const url = `${connection.url}/api/v1${path}`;
+		const headers = {
+			authorization: `Bearer ${connection.token}`,
+			...sent.token ? { "proxy-authorization": `Bearer ${sent.token}` } : {},
+			...body ? { "content-type": body.type } : {}
+		};
+		const response = await (connection.tlsName ? fetchCheckingName(connection.tlsName)(url, {
+			method,
+			headers,
+			body: body?.text,
+			signal
+		}) : fetch(url, {
 			method,
 			redirect: "manual",
-			headers: {
-				authorization: `Bearer ${connection.token}`,
-				...sent.token ? { "proxy-authorization": `Bearer ${sent.token}` } : {},
-				...body ? { "content-type": body.type } : {}
-			},
+			headers,
 			body: body?.text,
 			signal
+		})).catch((error) => {
+			if (signal?.aborted) throw error;
+			throw new ApiError(networkMessage(error, connection.url, connection.tlsName), 0);
 		});
 		const text = await response.text();
 		let parsed;
@@ -524,25 +592,29 @@ function parseLoginLine(line) {
 	return {
 		url: after("url"),
 		clientId: after("client-id"),
-		clientSecret: after("client-secret")
+		clientSecret: after("client-secret"),
+		tlsName: after("tls-name")
 	};
 }
 async function loginCommand(given = {}) {
 	let url = given.url ?? process.env.MODELOS_SECURE_URL;
-	let { clientId, clientSecret } = given;
+	let { clientId, clientSecret, tlsName } = given;
 	if (!url) {
 		const pasted = parseLoginLine(await askText("Where is ModelOS Secure? Paste the login command from the tokens page, or type the address:"));
 		url = pasted.url;
 		clientId ??= pasted.clientId;
 		clientSecret ??= pasted.clientSecret;
+		tlsName ??= pasted.tlsName;
 	}
+	tlsName ??= process.env.MODELOS_SECURE_TLS_NAME;
 	if (!url) throw new Error("A login needs the address. Copy the login command from the tokens page.");
 	if (clientId && !clientSecret) throw new Error("The client ID needs its client secret. Copy the whole login command from the tokens page.");
 	const token = process.env.MODELOS_SECURE_TOKEN ?? await askText("Paste a workspace token from the tokens page:", true);
 	if (!token) throw new Error("A login needs a workspace token. Create one on the tokens page.");
 	const connection = {
 		url: url.replace(/\/$/, ""),
-		token
+		token,
+		...tlsName ? { tlsName } : {}
 	};
 	if (clientId && clientSecret) connection.google = await signInWithGoogle(clientId, clientSecret);
 	const me = await apiClient(connection).get("/whoami");

package/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { _ as step, a as apiClient, c as Interrupted, d as blue, f as bold, g as say, h as red, i as IapRefusal, l as ask, m as grey, o as atAddress, p as dash, r as ApiError$1, s as readConnection, t as loginCommand, u as askText } from "./assets/login-B21lxf7i.js";
+import { _ as step, a as apiClient, c as Interrupted, d as blue, f as bold, g as say, h as red, i as IapRefusal, l as ask, m as grey, o as atAddress, p as dash, r as ApiError$1, s as readConnection, t as loginCommand, u as askText } from "./assets/login-WwE-Gunj.js";
 import { createRequire } from "node:module";
 import { existsSync } from "node:fs";
 import { fileURLToPath } from "node:url";
@@ -19485,7 +19485,7 @@ async function scanCommand(dir, options) {
 				label: "Enter a token now",
 				recommended: true,
 				apply: async () => {
-					const { loginCommand } = await import("./assets/login-CVPBOTvx.js");
+					const { loginCommand } = await import("./assets/login-BcHFyX6z.js");
 					await loginCommand();
 					const fresh = await readConnection();
 					api = fresh ? apiClient(fresh) : null;
@@ -19678,7 +19678,7 @@ function flag(name) {
 	const index = rest.indexOf(`--${name}`);
 	return index >= 0 ? rest[index + 1] : void 0;
 }
-var positional = rest.filter((arg, i) => !arg.startsWith("--") && !rest[i - 1]?.match(/^--(format|out|system|instances|against|budget|url|client-id|client-secret)$/));
+var positional = rest.filter((arg, i) => !arg.startsWith("--") && !rest[i - 1]?.match(/^--(format|out|system|instances|against|budget|url|client-id|client-secret|tls-name)$/));
 async function connection() {
 	const found = await readConnection();
 	if (!found) throw new Error("No workspace token found. Run modelos-secure login, or set MODELOS_SECURE_TOKEN.");
@@ -19687,7 +19687,8 @@ async function connection() {
 var USAGE = `modelos-secure: test an AI system for Security, Safety and Quality.
 
   login                   Saves a workspace token, and signs in with Google when the
-                          address needs it. --url, --client-id, --client-secret.
+                          address needs it. --url, --client-id, --client-secret,
+                          --tls-name.
   scan .                  Connects this repository. --offline, --explain, --yes.
   review                  Starts a review of this system. --quick, --ci, --budget.
   replay F-031            Replays one finding.
@@ -19703,7 +19704,8 @@ try {
 	if (command === "login") await loginCommand({
 		url: flag("url"),
 		clientId: flag("client-id"),
-		clientSecret: flag("client-secret")
+		clientSecret: flag("client-secret"),
+		tlsName: flag("tls-name")
 	});
 	else if (command === "scan") await scanCommand(resolve(positional[0] ?? "."), {
 		offline: has("offline"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "modelos-secure",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Tests AI systems for Security, Safety and Quality. One command connects a system from its code.",
   "license": "UNLICENSED",
   "repository": {

package/assets/login-CVPBOTvx.js

@@ -1 +0,0 @@
-export { t as loginCommand } from "./login-B21lxf7i.js";