neon 2.1.1 → 2.29.0

package/dist/auth.js

@@ -0,0 +1,127 @@
+import { createReadStream } from "node:fs";
+import { createServer, } from "node:http";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import open from "open";
+import * as client from "openid-client";
+import { sendError } from "./analytics.js";
+import { matchErrorCode } from "./errors.js";
+import { log } from "./log.js";
+import { extendTokenSet } from "./utils/auth.js";
+// oauth server timeouts
+const SERVER_TIMEOUT = 10000;
+// where to wait for incoming redirect request from oauth server to arrive
+const REDIRECT_URI = (port) => `http://127.0.0.1:${port}/callback`;
+// These scopes cannot be cancelled, they are always needed.
+const ALWAYS_PRESENT_SCOPES = ["openid", "offline", "offline_access"];
+const NEONCTL_SCOPES = [
+    ...ALWAYS_PRESENT_SCOPES,
+    "urn:neoncloud:projects:create",
+    "urn:neoncloud:projects:read",
+    "urn:neoncloud:projects:update",
+    "urn:neoncloud:projects:delete",
+    "urn:neoncloud:orgs:create",
+    "urn:neoncloud:orgs:read",
+    "urn:neoncloud:orgs:update",
+    "urn:neoncloud:orgs:delete",
+    "urn:neoncloud:orgs:permission",
+];
+const AUTH_TIMEOUT_SECONDS = 60;
+export const defaultClientID = "neonctl";
+export const refreshToken = async ({ oauthHost, clientId, allowUnsafeTls }, tokenSet) => {
+    log.debug("Discovering oauth server");
+    const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: "none" }, client.None(), {
+        timeout: SERVER_TIMEOUT,
+        execute: allowUnsafeTls
+            ? // eslint-disable-next-line @typescript-eslint/no-deprecated
+                [client.allowInsecureRequests]
+            : undefined,
+    });
+    return await client.refreshTokenGrant(configuration, tokenSet.refresh_token);
+};
+export const auth = async ({ oauthHost, clientId, allowUnsafeTls, }) => {
+    log.debug("Discovering oauth server");
+    const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: "none" }, client.None(), {
+        timeout: SERVER_TIMEOUT,
+        execute: allowUnsafeTls
+            ? // eslint-disable-next-line @typescript-eslint/no-deprecated
+                [client.allowInsecureRequests]
+            : undefined,
+    });
+    //
+    // Start HTTP server and wait till /callback is hit
+    //
+    log.debug("Starting HTTP Server for callback");
+    const server = createServer();
+    server.listen(0, "127.0.0.1", function () {
+        log.debug(`Listening on port ${this.address().port}`);
+    });
+    await new Promise((resolve) => server.once("listening", resolve));
+    const listen_port = server.address().port;
+    // https://datatracker.ietf.org/doc/html/rfc6819#section-4.4.1.8
+    const state = client.randomState();
+    // we store the code_verifier in memory
+    const codeVerifier = client.randomPKCECodeVerifier();
+    const codeChallenge = await client.calculatePKCECodeChallenge(codeVerifier);
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            reject(new Error(`Authentication timed out after ${AUTH_TIMEOUT_SECONDS} seconds`));
+        }, AUTH_TIMEOUT_SECONDS * 1000);
+        const onRequest = async (request, response) => {
+            //
+            // Wait for callback and follow oauth flow.
+            //
+            if (!request.url?.startsWith("/callback")) {
+                response.writeHead(404);
+                response.end();
+                return;
+            }
+            // process the CORS preflight OPTIONS request
+            if (request.method === "OPTIONS") {
+                response.writeHead(200, {
+                    "Access-Control-Allow-Origin": "*",
+                    "Access-Control-Allow-Methods": "GET, POST",
+                    "Access-Control-Allow-Headers": "Content-Type",
+                });
+                response.end();
+                return;
+            }
+            log.debug(`Callback received: ${request.url}`);
+            const tokenSet = await client.authorizationCodeGrant(configuration, new URL(request.url, `http://127.0.0.1:${listen_port}`), {
+                pkceCodeVerifier: codeVerifier,
+                expectedState: state,
+            });
+            response.writeHead(200, { "Content-Type": "text/html" });
+            createReadStream(join(fileURLToPath(new URL(".", import.meta.url)), "./callback.html")).pipe(response);
+            clearTimeout(timer);
+            const exp = new Date();
+            exp.setSeconds(exp.getSeconds() + (tokenSet.expires_in ?? 0));
+            resolve(extendTokenSet(tokenSet));
+            server.close();
+        };
+        server.on("request", (req, res) => {
+            void onRequest(req, res);
+        });
+        //
+        // Open browser to let user authenticate
+        //
+        const scopes = clientId == defaultClientID
+            ? NEONCTL_SCOPES
+            : ALWAYS_PRESENT_SCOPES;
+        const authUrl = client.buildAuthorizationUrl(configuration, {
+            scope: scopes.join(" "),
+            state,
+            code_challenge: codeChallenge,
+            code_challenge_method: "S256",
+            redirect_uri: REDIRECT_URI(listen_port),
+        });
+        log.info("Awaiting authentication in web browser.");
+        log.info(`Auth Url: ${authUrl}`);
+        open(authUrl.href).catch((err) => {
+            const msg = `Failed to open web browser. Please copy & paste auth url to authenticate in browser.`;
+            const typedErr = err && err instanceof Error ? err : undefined;
+            sendError(typedErr || new Error(msg), matchErrorCode(msg));
+            log.error(msg);
+        });
+    });
+};

package/dist/callback.html

@@ -0,0 +1,51 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <title>Neon</title>
+    <style>
+      body,
+      html {
+        width: 100%;
+        height: 100%;
+        margin: 0;
+        text-align: center;
+        font-family: 'Open Sans', sans-serif;
+        display: flex;
+        flex-direction: column;
+        justify-content: center;
+        align-items: center;
+        background-color: #ffffff;
+        color: #2d374c;
+      }
+      @media (prefers-color-scheme: dark) {
+        body,
+        html {
+          background-color: #191919;
+          color: #bfbfbf;
+        }
+      }
+      .logo {
+        display: inline-block;
+        width: 100px;
+        height: 100px;
+        margin: 0 auto;
+      }
+      svg {
+        overflow: visible;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="logo">
+      <svg viewBox="0 0 58 58" fill="none" xmlns="http://www.w3.org/2000/svg">
+        <path
+          d="M58 0.0162365V58L35.3688 38.5587V58H0V0L58 0.0162365ZM7.10962 50.9603H28.2591V23.1112L50.8907 42.937V7.05391L7.10962 7.04147V50.9603Z"
+          fill="#34D59A"
+        />
+      </svg>
+    </div>
+    <h1>Thank you for using Neon</h1>
+    <p>You may close this page now</p>
+  </body>
+</html>

package/dist/cli.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import { tryCurrentBranchFastPath } from "./current_branch_fast_path.js";
+// Fast path for the offline `(config) status --current-branch` probe (used by shell
+// prompts): read the pinned branch from `.neon` without loading the full command tree,
+// api-client, and yargs (~200ms). Falls through to the full CLI for everything else, so
+// the heavy `index.js` is imported lazily and only when actually needed.
+if (!tryCurrentBranchFastPath(process.argv)) {
+    void import("./index.js");
+}

package/dist/commands/auth.js

@@ -0,0 +1,214 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { getApiClient } from "../api.js";
+import { auth, refreshToken } from "../auth.js";
+import { CREDENTIALS_FILE } from "../config.js";
+import { isConfigInit, isCurrentBranchProbe } from "../context.js";
+import { isCi } from "../env.js";
+import { log } from "../log.js";
+import { extendTokenSet } from "../utils/auth.js";
+export const command = "auth";
+export const aliases = ["login"];
+export const describe = "Authenticate";
+export const builder = (yargs) => yargs.option("context-file", {
+    hidden: true,
+});
+export const handler = async (args) => {
+    await authFlow(args);
+};
+export const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceAuth, "force-auth": forceAuthKebab, allowUnsafeTls, }) => {
+    const allowInteractiveAuth = forceAuth ?? forceAuthKebab;
+    if (!allowInteractiveAuth && isCi()) {
+        throw new Error("Cannot run interactive auth in CI");
+    }
+    const tokenSet = await auth({
+        oauthHost: oauthHost,
+        clientId: clientId,
+        allowUnsafeTls,
+    });
+    const credentialsPath = join(configDir, CREDENTIALS_FILE);
+    try {
+        await preserveCredentials(credentialsPath, tokenSet, getApiClient({
+            apiKey: tokenSet.access_token || "",
+            apiHost,
+        }));
+    }
+    catch {
+        log.error("Failed to save credentials");
+        return "";
+    }
+    log.info("Auth complete");
+    return tokenSet.access_token || "";
+};
+const preserveCredentials = async (path, credentials, apiClient) => {
+    const { data: { id }, } = await apiClient.getCurrentUserInfo();
+    const contents = JSON.stringify({
+        // Making the linter happy by explicitly confirming we don't care about @typescript-eslint/no-misused-spread
+        ...credentials,
+        user_id: id,
+    });
+    // correctly sets needed permissions for the credentials file
+    writeFileSync(path, contents, {
+        mode: 0o700,
+    });
+    log.debug("Saved credentials to %s", path);
+    log.debug("Credentials MD5 hash: %s", md5hash(contents));
+};
+const handleExistingToken = async (tokenSet, props, credentialsPath) => {
+    // Use existing access_token, if present and valid
+    if (tokenSet.access_token && tokenSet.expires_at > Date.now()) {
+        log.debug("Using existing valid access_token");
+        const apiClient = getApiClient({
+            apiKey: tokenSet.access_token,
+            apiHost: props.apiHost,
+        });
+        return { apiKey: tokenSet.access_token, apiClient };
+    }
+    // Either access_token is missing or its expired. Refresh the token
+    log.debug(tokenSet.expires_at < Date.now()
+        ? "Token is expired, attempting refresh"
+        : "Token is missing access_token, attempting refresh");
+    if (!tokenSet.refresh_token) {
+        log.debug("TokenSet is missing refresh_token, starting authentication");
+        return null;
+    }
+    try {
+        const refreshedTokenSet = await refreshToken({
+            oauthHost: props.oauthHost,
+            clientId: props.clientId,
+            allowUnsafeTls: props.allowUnsafeTls,
+        }, tokenSet);
+        // Extend the token set with expires_at
+        const extendedTokenSet = extendTokenSet(refreshedTokenSet);
+        const apiKey = extendedTokenSet.access_token;
+        const apiClient = getApiClient({
+            apiKey,
+            apiHost: props.apiHost,
+        });
+        await preserveCredentials(credentialsPath, extendedTokenSet, apiClient);
+        log.debug("Token refresh successful");
+        return { apiKey, apiClient };
+    }
+    catch (err) {
+        const typedErr = err instanceof Error ? err : new Error("Unknown error");
+        log.debug("Failed to refresh token: %s", typedErr.message);
+        throw new Error("AUTH_REFRESH_FAILED");
+    }
+};
+export const ensureAuth = async (props) => {
+    // Skip auth for help command or no command
+    if (props._.length === 0 || props.help) {
+        return;
+    }
+    // `(config) status --current-branch` is a purely-local read of `.neon`; it must
+    // never refresh a token or pop a browser login. Skip auth entirely (the handler
+    // doesn't use an API client in this mode).
+    if (isCurrentBranchProbe(props)) {
+        return;
+    }
+    // `config init` only scaffolds a neon.ts and installs npm packages locally; it
+    // never calls the Neon API, so skip auth entirely — no token refresh, no login.
+    if (isConfigInit(props)) {
+        return;
+    }
+    // `dev` runs a function locally. It injects the selected branch's env vars
+    // when credentials happen to be available, but must never trigger an
+    // interactive login: use an API key or existing stored credentials if
+    // present, otherwise run with no API client (env injection is skipped).
+    const isLocalDev = props._[0] === "dev";
+    // `bootstrap` only copies a public template repo; it never calls the Neon
+    // API, so it must work without credentials and must never pop a browser
+    // login. It uses an API key / stored credentials when present (harmless),
+    // otherwise it proceeds with no API client.
+    const isBootstrap = props._[0] === "bootstrap";
+    // `init` manages its own auth flow (asks the user if they have an account,
+    // then triggers OAuth at the right time). Skip the global auth middleware.
+    const isInit = props._[0] === "init";
+    // Use existing API key or handle auth command
+    if (props.apiKey || props._[0] === "auth") {
+        if (props.apiKey) {
+            log.debug("Using an API key to authorize requests");
+        }
+        props.apiClient = getApiClient({
+            apiKey: props.apiKey,
+            apiHost: props.apiHost,
+        });
+        return;
+    }
+    const credentialsPath = join(props.configDir, CREDENTIALS_FILE);
+    // Handle case when credentials file exists
+    if (existsSync(credentialsPath)) {
+        log.debug("Trying to read credentials from %s", credentialsPath);
+        try {
+            const contents = readFileSync(credentialsPath, "utf8");
+            log.debug("Credentials MD5 hash: %s", md5hash(contents));
+            const tokenSet = JSON.parse(contents);
+            // Try to use existing token or refresh it
+            const result = await handleExistingToken(tokenSet, props, credentialsPath);
+            if (result) {
+                props.apiKey = result.apiKey;
+                props.apiClient = result.apiClient;
+                return;
+            }
+        }
+        catch (err) {
+            if (!(err instanceof Error &&
+                err.message === "AUTH_REFRESH_FAILED") &&
+                err.code !== "ENOENT" &&
+                !(err instanceof SyntaxError)) {
+                // Throw for any errors except auth refresh failure, missing file, or invalid credentials file
+                throw err;
+            }
+            // Fall through to new auth flow for auth failures
+            log.debug("Ensure auth failed, starting authentication", err);
+        }
+    }
+    else {
+        log.debug("Credentials file %s does not exist, starting authentication", credentialsPath);
+    }
+    // `dev` never launches the interactive browser flow. With no usable
+    // credentials it proceeds without an API client; env injection is skipped
+    // and the function still runs locally.
+    if (isLocalDev) {
+        log.debug("dev: no usable credentials; running without env injection");
+        return;
+    }
+    if (isBootstrap) {
+        log.debug("bootstrap: no usable credentials; continuing without auth");
+        return;
+    }
+    if (isInit) {
+        log.debug("init: skipping global auth; init manages its own auth flow");
+        return;
+    }
+    // Start new auth flow if no valid token exists or refresh failed
+    const apiKey = await authFlow(props);
+    props.apiKey = apiKey;
+    props.apiClient = getApiClient({
+        apiKey,
+        apiHost: props.apiHost,
+    });
+};
+/**
+ * Deletes the credentials file at the specified path
+ * @param configDir Directory where credentials file is stored
+ */
+export const deleteCredentials = (configDir) => {
+    const credentialsPath = join(configDir, CREDENTIALS_FILE);
+    try {
+        if (existsSync(credentialsPath)) {
+            rmSync(credentialsPath);
+            log.info("Deleted credentials from %s", credentialsPath);
+        }
+        else {
+            log.debug("Credentials file %s does not exist", credentialsPath);
+        }
+    }
+    catch (err) {
+        const typedErr = err instanceof Error ? err : new Error("Unknown error");
+        log.error("Failed to delete credentials: %s", typedErr.message);
+        throw new Error("CREDENTIALS_DELETE_FAILED");
+    }
+};
+const md5hash = (s) => createHash("md5").update(s).digest("hex");