modelos-secure 0.1.0 → 0.1.2

package/README.md

@@ -29,6 +29,8 @@ npx modelos-secure login --url <address> --client-id <client ID> --client-secret
 
 Paste the workspace token when it asks. The token is never typed on the command line. Your browser then opens for you to sign in with Google. The address, the token and the Google sign-in are kept in `~/.modelos-secure/credentials.json`, readable only by you, and the sign-in is renewed as it runs out. Without `--client-id`, as on a local stack, there is no Google sign-in.
 
+When the app is reached at an IP address and its certificate is issued for a name, the login command also has `--tls-name` and that name. The CLI then connects to the address and checks the certificate against the name: its chain, its dates and the name are all still checked. `MODELOS_SECURE_TLS_NAME` does the same for one run. When something cannot be reached, the CLI says why in plain words.
+
 `MODELOS_SECURE_URL` and `MODELOS_SECURE_TOKEN` take the place of the saved address and token. `modelos-secure doctor` says who is signed in to Google, and why a request was turned away.
 
 ## In CI

package/assets/login-BoqCvsTW.js

@@ -0,0 +1 @@
+export { t as loginCommand } from "./login-JPkrnvZC.js";

package/assets/{login-B21lxf7i.js → login-JPkrnvZC.js}

@@ -5,6 +5,8 @@ import { execFile, spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 import { emitKeypressEvents } from "node:readline";
+import { request } from "node:https";
+import { checkServerIdentity } from "node:tls";
 // src/ui.ts
 var color = process.stdout.isTTY && !process.env.NO_COLOR;
 var unicode = process.env.TERM !== "dumb" && !process.env.MODELOS_SECURE_ASCII;
@@ -276,6 +278,61 @@ function gcloudIdentityToken(audience) {
 		});
 	});
 }
+// src/tls.ts
+/** A fetch that connects to the URL's host and checks its certificate against `name`. */
+function fetchCheckingName(name) {
+	return (url, init = {}) => new Promise((resolve, reject) => {
+		const outgoing = request(new URL(url), {
+			method: init.method ?? "GET",
+			headers: init.headers,
+			servername: name,
+			checkServerIdentity: (_host, certificate) => checkServerIdentity(name, certificate),
+			signal: init.signal
+		}, (incoming) => {
+			const chunks = [];
+			incoming.on("data", (chunk) => chunks.push(chunk));
+			incoming.on("error", reject);
+			incoming.on("end", () => {
+				const headers = new Headers();
+				for (const [key, value] of Object.entries(incoming.headers)) if (value !== void 0) headers.set(key, Array.isArray(value) ? value.join(", ") : value);
+				const status = incoming.statusCode ?? 502;
+				resolve(new Response(status === 204 || status === 304 ? null : Buffer.concat(chunks), {
+					status,
+					headers
+				}));
+			});
+		});
+		outgoing.on("error", reject);
+		if (init.body !== void 0) outgoing.write(init.body);
+		outgoing.end();
+	});
+}
+/** What went wrong reaching an address, in plain words, from the error Node gave. */
+function networkMessage(error, url, tlsName) {
+	const cause = error?.cause;
+	const code = (typeof cause?.code === "string" ? cause.code : void 0) ?? error?.code;
+	let host = url;
+	try {
+		host = new URL(url).hostname;
+	} catch {}
+	switch (code) {
+		case "ERR_TLS_CERT_ALTNAME_INVALID": return tlsName ? `The certificate at ${host} is not issued for ${tlsName}. Copy the login command from the tokens page again.` : `The certificate at ${host} is not issued for that address. If it is issued for a name, such as one in your company's domain, log in again with --tls-name and that name.`;
+		case "DEPTH_ZERO_SELF_SIGNED_CERT":
+		case "SELF_SIGNED_CERT_IN_CHAIN":
+		case "UNABLE_TO_VERIFY_LEAF_SIGNATURE":
+		case "UNABLE_TO_GET_ISSUER_CERT_LOCALLY": return `This machine does not trust the certificate at ${host}. If your company adds its own certificates to this machine, set NODE_OPTIONS=--use-system-ca and try again.`;
+		case "CERT_HAS_EXPIRED": return `The certificate at ${host} has expired. Tell whoever runs that address.`;
+		case "ENOTFOUND":
+		case "EAI_AGAIN": return `${host} cannot be found from this machine. Check the address.`;
+		case "ECONNREFUSED":
+		case "ECONNRESET":
+		case "ETIMEDOUT":
+		case "EHOSTUNREACH":
+		case "ENETUNREACH":
+		case "UND_ERR_CONNECT_TIMEOUT": return `${host} cannot be reached from this machine. It may only be reachable on the company network.`;
+		default: return `The request to ${host} failed${code ? ` (${code})` : ""}.`;
+	}
+}
 // src/iap.ts
 /**
 * The Google credential for one connection, in this order: MODELOS_SECURE_IAP_TOKEN as it is;
@@ -369,13 +426,27 @@ function refusalKind(answer) {
 	if (!json && status < 500 && (status < 300 || page)) return "not-the-app";
 	return null;
 }
+/**
+* IAP's own words for a refusal, when it gave them as plain text, such as "Invalid bearer token.
+* Audience doesn't match the allowlisted oauth clients for this application." A page gives none.
+*/
+function iapReason(headers, text) {
+	if ((headers.get("content-type") ?? "").includes("html")) return void 0;
+	const line = text.trim().split("\n")[0]?.trim() ?? "";
+	if (!(headers.get("x-goog-iap-generated-response") === "true" || line.startsWith("Invalid IAP credentials")) || !line || line.startsWith("<")) return void 0;
+	const words = line.replace(/^Invalid IAP credentials:\s*/i, "").slice(0, 240).trim();
+	if (!words) return void 0;
+	return /[.!?]$/.test(words) ? words : `${words}.`;
+}
 /** What happened, why, and what to do, in the voice of the CLI's other failures. */
-function refusalMessage(kind, credential, url, ci = Boolean(process.env.CI)) {
+function refusalMessage(kind, credential, url, ci = Boolean(process.env.CI), detail = {}) {
 	if (kind === "not-the-app") return `${url} answered, but it is not ModelOS Secure. Check the address against the login command on the tokens page.`;
 	if (kind === "no-sign-in") return ci ? "This address needs a Google sign-in, and none was found. In CI, set MODELOS_SECURE_CLIENT_ID with gcloud signed in as a service account, or set MODELOS_SECURE_IAP_TOKEN." : "This address needs a Google sign-in, and this machine has none yet. Run modelos-secure login with the command from the tokens page.";
 	if (kind === "not-allowed") return credential.email ? `You are signed in to Google as ${credential.email}, but that account is not allowed through to ModelOS Secure. Ask whoever runs ModelOS Secure to give it access.` : "This Google account is not allowed through to ModelOS Secure. Ask whoever runs ModelOS Secure to give it access.";
-	if (credential.source === "env") return "Google refused the token in MODELOS_SECURE_IAP_TOKEN: it has expired, or it was made for another client ID. Make a new one for the client ID on the tokens page.";
-	if (credential.source === "gcloud") return "Google refused the identity token from gcloud: it was made for another client ID, or the account is not a service account. Check MODELOS_SECURE_CLIENT_ID against the tokens page.";
+	const said = detail.reason ? `It said: ${detail.reason}` : detail.redirected ? "It sent the request to its sign-in page instead." : "";
+	if (credential.source === "env") return `Google refused the token in MODELOS_SECURE_IAP_TOKEN: it has expired, or it was made for another client ID. Make a new one for the client ID on the tokens page.${said ? ` ${said}` : ""}`;
+	if (credential.source === "gcloud") return `Google refused the identity token from gcloud: it was made for another client ID, or the account is not a service account. Check MODELOS_SECURE_CLIENT_ID against the tokens page.${said ? ` ${said}` : ""}`;
+	if (said) return `Google did not let your sign-in through to ModelOS Secure. ${said} Run modelos-secure login again. If it says the same, send this message to whoever runs ModelOS Secure.`;
 	return "Google refused your sign-in: it has expired or was revoked. Run modelos-secure login again.";
 }
 // src/api.ts
@@ -390,14 +461,14 @@ async function readConnection() {
 	const url = process.env.MODELOS_SECURE_URL ?? saved?.url;
 	const token = process.env.MODELOS_SECURE_TOKEN ?? saved?.token;
 	if (!url || !token) return null;
-	const google = saved?.google && saved.url && trim(saved.url) === trim(url) ? saved.google : void 0;
-	return google ? {
+	const same = Boolean(saved?.url && trim(saved.url) === trim(url));
+	const google = same ? saved?.google : void 0;
+	const tlsName = process.env.MODELOS_SECURE_TLS_NAME ?? (same ? saved?.tlsName : void 0);
+	return {
 		url: trim(url),
 		token,
-		google
-	} : {
-		url: trim(url),
-		token
+		...google ? { google } : {},
+		...tlsName ? { tlsName } : {}
 	};
 }
 /** The same connection at another address. The Google sign-in goes only to the same origin. */
@@ -431,7 +502,8 @@ async function saveRenewed(url, google) {
 	if (saved?.url && saved.token && trim(saved.url) === url && saved.google?.clientId === google.clientId) await saveConnection({
 		url: saved.url,
 		token: saved.token,
-		google
+		google,
+		...saved.tlsName ? { tlsName: saved.tlsName } : {}
 	});
 }
 var ApiError = class extends Error {
@@ -468,16 +540,26 @@ function apiClient(connection, options = {}) {
 	};
 	const call = async (method, path, body, signal) => {
 		const sent = await credential();
-		const response = await fetch(`${connection.url}/api/v1${path}`, {
+		const url = `${connection.url}/api/v1${path}`;
+		const headers = {
+			authorization: `Bearer ${sent.token ?? connection.token}`,
+			"x-modelos-secure-token": connection.token,
+			...body ? { "content-type": body.type } : {}
+		};
+		const response = await (connection.tlsName ? fetchCheckingName(connection.tlsName)(url, {
+			method,
+			headers,
+			body: body?.text,
+			signal
+		}) : fetch(url, {
 			method,
 			redirect: "manual",
-			headers: {
-				authorization: `Bearer ${connection.token}`,
-				...sent.token ? { "proxy-authorization": `Bearer ${sent.token}` } : {},
-				...body ? { "content-type": body.type } : {}
-			},
+			headers,
 			body: body?.text,
 			signal
+		})).catch((error) => {
+			if (signal?.aborted) throw error;
+			throw new ApiError(networkMessage(error, connection.url, connection.tlsName), 0);
 		});
 		const text = await response.text();
 		let parsed;
@@ -492,7 +574,10 @@ function apiClient(connection, options = {}) {
 			body: parsed,
 			sent: Boolean(sent.token)
 		});
-		if (kind) throw new IapRefusal(kind, response.status, refusalMessage(kind, sent, connection.url));
+		if (kind) throw new IapRefusal(kind, response.status, refusalMessage(kind, sent, connection.url, void 0, {
+			reason: iapReason(response.headers, text),
+			redirected: response.status >= 300 && response.status < 400
+		}));
 		if (!response.ok) {
 			const error = typeof parsed === "object" && parsed !== null ? parsed.error : void 0;
 			throw new ApiError(typeof error === "string" ? error : `The server answered ${response.status.toString()}.`, response.status);
@@ -524,25 +609,29 @@ function parseLoginLine(line) {
 	return {
 		url: after("url"),
 		clientId: after("client-id"),
-		clientSecret: after("client-secret")
+		clientSecret: after("client-secret"),
+		tlsName: after("tls-name")
 	};
 }
 async function loginCommand(given = {}) {
 	let url = given.url ?? process.env.MODELOS_SECURE_URL;
-	let { clientId, clientSecret } = given;
+	let { clientId, clientSecret, tlsName } = given;
 	if (!url) {
 		const pasted = parseLoginLine(await askText("Where is ModelOS Secure? Paste the login command from the tokens page, or type the address:"));
 		url = pasted.url;
 		clientId ??= pasted.clientId;
 		clientSecret ??= pasted.clientSecret;
+		tlsName ??= pasted.tlsName;
 	}
+	tlsName ??= process.env.MODELOS_SECURE_TLS_NAME;
 	if (!url) throw new Error("A login needs the address. Copy the login command from the tokens page.");
 	if (clientId && !clientSecret) throw new Error("The client ID needs its client secret. Copy the whole login command from the tokens page.");
 	const token = process.env.MODELOS_SECURE_TOKEN ?? await askText("Paste a workspace token from the tokens page:", true);
 	if (!token) throw new Error("A login needs a workspace token. Create one on the tokens page.");
 	const connection = {
 		url: url.replace(/\/$/, ""),
-		token
+		token,
+		...tlsName ? { tlsName } : {}
 	};
 	if (clientId && clientSecret) connection.google = await signInWithGoogle(clientId, clientSecret);
 	const me = await apiClient(connection).get("/whoami");

package/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { _ as step, a as apiClient, c as Interrupted, d as blue, f as bold, g as say, h as red, i as IapRefusal, l as ask, m as grey, o as atAddress, p as dash, r as ApiError$1, s as readConnection, t as loginCommand, u as askText } from "./assets/login-B21lxf7i.js";
+import { _ as step, a as apiClient, c as Interrupted, d as blue, f as bold, g as say, h as red, i as IapRefusal, l as ask, m as grey, o as atAddress, p as dash, r as ApiError$1, s as readConnection, t as loginCommand, u as askText } from "./assets/login-JPkrnvZC.js";
 import { createRequire } from "node:module";
 import { existsSync } from "node:fs";
 import { fileURLToPath } from "node:url";
@@ -19485,7 +19485,7 @@ async function scanCommand(dir, options) {
 				label: "Enter a token now",
 				recommended: true,
 				apply: async () => {
-					const { loginCommand } = await import("./assets/login-CVPBOTvx.js");
+					const { loginCommand } = await import("./assets/login-BoqCvsTW.js");
 					await loginCommand();
 					const fresh = await readConnection();
 					api = fresh ? apiClient(fresh) : null;
@@ -19678,7 +19678,7 @@ function flag(name) {
 	const index = rest.indexOf(`--${name}`);
 	return index >= 0 ? rest[index + 1] : void 0;
 }
-var positional = rest.filter((arg, i) => !arg.startsWith("--") && !rest[i - 1]?.match(/^--(format|out|system|instances|against|budget|url|client-id|client-secret)$/));
+var positional = rest.filter((arg, i) => !arg.startsWith("--") && !rest[i - 1]?.match(/^--(format|out|system|instances|against|budget|url|client-id|client-secret|tls-name)$/));
 async function connection() {
 	const found = await readConnection();
 	if (!found) throw new Error("No workspace token found. Run modelos-secure login, or set MODELOS_SECURE_TOKEN.");
@@ -19687,7 +19687,8 @@ async function connection() {
 var USAGE = `modelos-secure: test an AI system for Security, Safety and Quality.
 
   login                   Saves a workspace token, and signs in with Google when the
-                          address needs it. --url, --client-id, --client-secret.
+                          address needs it. --url, --client-id, --client-secret,
+                          --tls-name.
   scan .                  Connects this repository. --offline, --explain, --yes.
   review                  Starts a review of this system. --quick, --ci, --budget.
   replay F-031            Replays one finding.
@@ -19703,7 +19704,8 @@ try {
 	if (command === "login") await loginCommand({
 		url: flag("url"),
 		clientId: flag("client-id"),
-		clientSecret: flag("client-secret")
+		clientSecret: flag("client-secret"),
+		tlsName: flag("tls-name")
 	});
 	else if (command === "scan") await scanCommand(resolve(positional[0] ?? "."), {
 		offline: has("offline"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "modelos-secure",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Tests AI systems for Security, Safety and Quality. One command connects a system from its code.",
   "license": "UNLICENSED",
   "repository": {

package/assets/login-CVPBOTvx.js

@@ -1 +0,0 @@
-export { t as loginCommand } from "./login-B21lxf7i.js";