modelos-secure 0.1.1 → 0.2.0

package/assets/login-CipN1qFD.js

@@ -0,0 +1 @@
+export { t as loginCommand } from "./login-DZgP66jr.js";

package/assets/{login-WwE-Gunj.js → login-DZgP66jr.js}

@@ -5,7 +5,7 @@ import { execFile, spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 import { emitKeypressEvents } from "node:readline";
-import { request } from "node:https";
+import { request as request$1 } from "node:https";
 import { checkServerIdentity } from "node:tls";
 // src/ui.ts
 var color = process.stdout.isTTY && !process.env.NO_COLOR;
@@ -22,7 +22,22 @@ function say(line = "") {
 	console.log(line);
 }
 var STEP_WIDTH = 13;
+var lastStep = "";
+/** The last step that finished, so a stop can say where it happened. */
+var lastFinishedStep = () => lastStep;
+/** Work to finish before the process ends on Ctrl-C, such as stopping a review it started. */
+var onStop = [];
+function beforeStopping(work) {
+	onStop.push(work);
+	return () => {
+		onStop.splice(onStop.indexOf(work), 1);
+	};
+}
+async function finishBeforeStopping() {
+	await Promise.race([Promise.allSettled(onStop.map((work) => work())), new Promise((resolve) => setTimeout(resolve, 5e3))]);
+}
 function step(name, detail, state = "done") {
+	if (state === "done") lastStep = name;
 	const right = state === "done" ? "done" : "";
 	say(`  ${bold(name.padEnd(STEP_WIDTH))}${detail}${right ? `  ${grey(right)}` : ""}`);
 }
@@ -83,15 +98,19 @@ async function ask(question, why, choices) {
 async function askText(question, secret = false) {
 	process.stdout.write(`  ${question} `);
 	if (!interactive()) return "";
-	return new Promise((resolve) => {
+	return new Promise((resolve, reject) => {
 		let value = "";
 		emitKeypressEvents(process.stdin);
 		process.stdin.setRawMode(true);
 		process.stdin.resume();
 		const onKey = (text, key) => {
 			if (key.ctrl && key.name === "c") {
+				process.stdin.off("keypress", onKey);
 				process.stdin.setRawMode(false);
-				process.exit(130);
+				process.stdin.pause();
+				process.stdout.write("\n");
+				reject(new Interrupted());
+				return;
 			}
 			if (key.name === "return") {
 				process.stdin.off("keypress", onKey);
@@ -282,7 +301,7 @@ function gcloudIdentityToken(audience) {
 /** A fetch that connects to the URL's host and checks its certificate against `name`. */
 function fetchCheckingName(name) {
 	return (url, init = {}) => new Promise((resolve, reject) => {
-		const outgoing = request(new URL(url), {
+		const outgoing = request$1(new URL(url), {
 			method: init.method ?? "GET",
 			headers: init.headers,
 			servername: name,
@@ -426,13 +445,27 @@ function refusalKind(answer) {
 	if (!json && status < 500 && (status < 300 || page)) return "not-the-app";
 	return null;
 }
+/**
+* IAP's own words for a refusal, when it gave them as plain text, such as "Invalid bearer token.
+* Audience doesn't match the allowlisted oauth clients for this application." A page gives none.
+*/
+function iapReason(headers, text) {
+	if ((headers.get("content-type") ?? "").includes("html")) return void 0;
+	const line = text.trim().split("\n")[0]?.trim() ?? "";
+	if (!(headers.get("x-goog-iap-generated-response") === "true" || line.startsWith("Invalid IAP credentials")) || !line || line.startsWith("<")) return void 0;
+	const words = line.replace(/^Invalid IAP credentials:\s*/i, "").slice(0, 240).trim();
+	if (!words) return void 0;
+	return /[.!?]$/.test(words) ? words : `${words}.`;
+}
 /** What happened, why, and what to do, in the voice of the CLI's other failures. */
-function refusalMessage(kind, credential, url, ci = Boolean(process.env.CI)) {
+function refusalMessage(kind, credential, url, ci = Boolean(process.env.CI), detail = {}) {
 	if (kind === "not-the-app") return `${url} answered, but it is not ModelOS Secure. Check the address against the login command on the tokens page.`;
 	if (kind === "no-sign-in") return ci ? "This address needs a Google sign-in, and none was found. In CI, set MODELOS_SECURE_CLIENT_ID with gcloud signed in as a service account, or set MODELOS_SECURE_IAP_TOKEN." : "This address needs a Google sign-in, and this machine has none yet. Run modelos-secure login with the command from the tokens page.";
 	if (kind === "not-allowed") return credential.email ? `You are signed in to Google as ${credential.email}, but that account is not allowed through to ModelOS Secure. Ask whoever runs ModelOS Secure to give it access.` : "This Google account is not allowed through to ModelOS Secure. Ask whoever runs ModelOS Secure to give it access.";
-	if (credential.source === "env") return "Google refused the token in MODELOS_SECURE_IAP_TOKEN: it has expired, or it was made for another client ID. Make a new one for the client ID on the tokens page.";
-	if (credential.source === "gcloud") return "Google refused the identity token from gcloud: it was made for another client ID, or the account is not a service account. Check MODELOS_SECURE_CLIENT_ID against the tokens page.";
+	const said = detail.reason ? `It said: ${detail.reason}` : detail.redirected ? "It sent the request to its sign-in page instead." : "";
+	if (credential.source === "env") return `Google refused the token in MODELOS_SECURE_IAP_TOKEN: it has expired, or it was made for another client ID. Make a new one for the client ID on the tokens page.${said ? ` ${said}` : ""}`;
+	if (credential.source === "gcloud") return `Google refused the identity token from gcloud: it was made for another client ID, or the account is not a service account. Check MODELOS_SECURE_CLIENT_ID against the tokens page.${said ? ` ${said}` : ""}`;
+	if (said) return `Google did not let your sign-in through to ModelOS Secure. ${said} Run modelos-secure login again. If it says the same, send this message to whoever runs ModelOS Secure.`;
 	return "Google refused your sign-in: it has expired or was revoked. Run modelos-secure login again.";
 }
 // src/api.ts
@@ -528,8 +561,8 @@ function apiClient(connection, options = {}) {
 		const sent = await credential();
 		const url = `${connection.url}/api/v1${path}`;
 		const headers = {
-			authorization: `Bearer ${connection.token}`,
-			...sent.token ? { "proxy-authorization": `Bearer ${sent.token}` } : {},
+			authorization: `Bearer ${sent.token ?? connection.token}`,
+			"x-modelos-secure-token": connection.token,
 			...body ? { "content-type": body.type } : {}
 		};
 		const response = await (connection.tlsName ? fetchCheckingName(connection.tlsName)(url, {
@@ -560,7 +593,10 @@ function apiClient(connection, options = {}) {
 			body: parsed,
 			sent: Boolean(sent.token)
 		});
-		if (kind) throw new IapRefusal(kind, response.status, refusalMessage(kind, sent, connection.url));
+		if (kind) throw new IapRefusal(kind, response.status, refusalMessage(kind, sent, connection.url, void 0, {
+			reason: iapReason(response.headers, text),
+			redirected: response.status >= 300 && response.status < 400
+		}));
 		if (!response.ok) {
 			const error = typeof parsed === "object" && parsed !== null ? parsed.error : void 0;
 			throw new ApiError(typeof error === "string" ? error : `The server answered ${response.status.toString()}.`, response.status);
@@ -622,4 +658,4 @@ async function loginCommand(given = {}) {
 	const who = connection.google?.email;
 	say(`Saved. This machine now works in ${me.workspace}${who ? `, signed in to Google as ${who}` : ""}.`);
 }
-export { step as _, apiClient as a, Interrupted as c, blue as d, bold as f, say as g, red as h, IapRefusal as i, ask as l, grey as m, parseLoginLine as n, atAddress as o, dash as p, ApiError as r, readConnection as s, loginCommand as t, askText as u };
+export { interactive as _, apiClient as a, say as b, Interrupted as c, beforeStopping as d, blue as f, grey as g, finishBeforeStopping as h, IapRefusal as i, ask as l, dash as m, parseLoginLine as n, atAddress as o, bold as p, ApiError as r, readConnection as s, loginCommand as t, askText as u, lastFinishedStep as v, step as x, red as y };