modelos-secure 0.1.1 → 0.1.2

package/assets/login-BoqCvsTW.js

@@ -0,0 +1 @@
+export { t as loginCommand } from "./login-JPkrnvZC.js";

package/assets/{login-WwE-Gunj.js → login-JPkrnvZC.js}

@@ -426,13 +426,27 @@ function refusalKind(answer) {
 	if (!json && status < 500 && (status < 300 || page)) return "not-the-app";
 	return null;
 }
+/**
+* IAP's own words for a refusal, when it gave them as plain text, such as "Invalid bearer token.
+* Audience doesn't match the allowlisted oauth clients for this application." A page gives none.
+*/
+function iapReason(headers, text) {
+	if ((headers.get("content-type") ?? "").includes("html")) return void 0;
+	const line = text.trim().split("\n")[0]?.trim() ?? "";
+	if (!(headers.get("x-goog-iap-generated-response") === "true" || line.startsWith("Invalid IAP credentials")) || !line || line.startsWith("<")) return void 0;
+	const words = line.replace(/^Invalid IAP credentials:\s*/i, "").slice(0, 240).trim();
+	if (!words) return void 0;
+	return /[.!?]$/.test(words) ? words : `${words}.`;
+}
 /** What happened, why, and what to do, in the voice of the CLI's other failures. */
-function refusalMessage(kind, credential, url, ci = Boolean(process.env.CI)) {
+function refusalMessage(kind, credential, url, ci = Boolean(process.env.CI), detail = {}) {
 	if (kind === "not-the-app") return `${url} answered, but it is not ModelOS Secure. Check the address against the login command on the tokens page.`;
 	if (kind === "no-sign-in") return ci ? "This address needs a Google sign-in, and none was found. In CI, set MODELOS_SECURE_CLIENT_ID with gcloud signed in as a service account, or set MODELOS_SECURE_IAP_TOKEN." : "This address needs a Google sign-in, and this machine has none yet. Run modelos-secure login with the command from the tokens page.";
 	if (kind === "not-allowed") return credential.email ? `You are signed in to Google as ${credential.email}, but that account is not allowed through to ModelOS Secure. Ask whoever runs ModelOS Secure to give it access.` : "This Google account is not allowed through to ModelOS Secure. Ask whoever runs ModelOS Secure to give it access.";
-	if (credential.source === "env") return "Google refused the token in MODELOS_SECURE_IAP_TOKEN: it has expired, or it was made for another client ID. Make a new one for the client ID on the tokens page.";
-	if (credential.source === "gcloud") return "Google refused the identity token from gcloud: it was made for another client ID, or the account is not a service account. Check MODELOS_SECURE_CLIENT_ID against the tokens page.";
+	const said = detail.reason ? `It said: ${detail.reason}` : detail.redirected ? "It sent the request to its sign-in page instead." : "";
+	if (credential.source === "env") return `Google refused the token in MODELOS_SECURE_IAP_TOKEN: it has expired, or it was made for another client ID. Make a new one for the client ID on the tokens page.${said ? ` ${said}` : ""}`;
+	if (credential.source === "gcloud") return `Google refused the identity token from gcloud: it was made for another client ID, or the account is not a service account. Check MODELOS_SECURE_CLIENT_ID against the tokens page.${said ? ` ${said}` : ""}`;
+	if (said) return `Google did not let your sign-in through to ModelOS Secure. ${said} Run modelos-secure login again. If it says the same, send this message to whoever runs ModelOS Secure.`;
 	return "Google refused your sign-in: it has expired or was revoked. Run modelos-secure login again.";
 }
 // src/api.ts
@@ -528,8 +542,8 @@ function apiClient(connection, options = {}) {
 		const sent = await credential();
 		const url = `${connection.url}/api/v1${path}`;
 		const headers = {
-			authorization: `Bearer ${connection.token}`,
-			...sent.token ? { "proxy-authorization": `Bearer ${sent.token}` } : {},
+			authorization: `Bearer ${sent.token ?? connection.token}`,
+			"x-modelos-secure-token": connection.token,
 			...body ? { "content-type": body.type } : {}
 		};
 		const response = await (connection.tlsName ? fetchCheckingName(connection.tlsName)(url, {
@@ -560,7 +574,10 @@ function apiClient(connection, options = {}) {
 			body: parsed,
 			sent: Boolean(sent.token)
 		});
-		if (kind) throw new IapRefusal(kind, response.status, refusalMessage(kind, sent, connection.url));
+		if (kind) throw new IapRefusal(kind, response.status, refusalMessage(kind, sent, connection.url, void 0, {
+			reason: iapReason(response.headers, text),
+			redirected: response.status >= 300 && response.status < 400
+		}));
 		if (!response.ok) {
 			const error = typeof parsed === "object" && parsed !== null ? parsed.error : void 0;
 			throw new ApiError(typeof error === "string" ? error : `The server answered ${response.status.toString()}.`, response.status);

package/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { _ as step, a as apiClient, c as Interrupted, d as blue, f as bold, g as say, h as red, i as IapRefusal, l as ask, m as grey, o as atAddress, p as dash, r as ApiError$1, s as readConnection, t as loginCommand, u as askText } from "./assets/login-WwE-Gunj.js";
+import { _ as step, a as apiClient, c as Interrupted, d as blue, f as bold, g as say, h as red, i as IapRefusal, l as ask, m as grey, o as atAddress, p as dash, r as ApiError$1, s as readConnection, t as loginCommand, u as askText } from "./assets/login-JPkrnvZC.js";
 import { createRequire } from "node:module";
 import { existsSync } from "node:fs";
 import { fileURLToPath } from "node:url";
@@ -19485,7 +19485,7 @@ async function scanCommand(dir, options) {
 				label: "Enter a token now",
 				recommended: true,
 				apply: async () => {
-					const { loginCommand } = await import("./assets/login-BcHFyX6z.js");
+					const { loginCommand } = await import("./assets/login-BoqCvsTW.js");
 					await loginCommand();
 					const fresh = await readConnection();
 					api = fresh ? apiClient(fresh) : null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "modelos-secure",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Tests AI systems for Security, Safety and Quality. One command connects a system from its code.",
   "license": "UNLICENSED",
   "repository": {

package/assets/login-BcHFyX6z.js

@@ -1 +0,0 @@
-export { t as loginCommand } from "./login-WwE-Gunj.js";