neon 2.47.0 → 3.1.0

package/dist/auth.js

@@ -1,154 +1,134 @@
+import { log } from "./log.js";
+import { sendError } from "./analytics.js";
+import { matchErrorCode } from "./errors.js";
+import { extendTokenSet } from "./utils/auth.js";
 import { createReadStream } from "node:fs";
-import { createServer, } from "node:http";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { createServer } from "node:http";
 import open from "open";
 import * as client from "openid-client";
-import { sendError } from "./analytics.js";
-import { matchErrorCode } from "./errors.js";
-import { log } from "./log.js";
-import { extendTokenSet } from "./utils/auth.js";
-// oauth server timeouts
-const SERVER_TIMEOUT = 10000;
-// where to wait for incoming redirect request from oauth server to arrive
+//#region src/auth.ts
+const SERVER_TIMEOUT = 1e4;
 const REDIRECT_URI = (port) => `http://127.0.0.1:${port}/callback`;
-// These scopes cannot be cancelled, they are always needed.
-const ALWAYS_PRESENT_SCOPES = ["openid", "offline", "offline_access"];
+const ALWAYS_PRESENT_SCOPES = [
+	"openid",
+	"offline",
+	"offline_access"
+];
 const NEONCTL_SCOPES = [
-    ...ALWAYS_PRESENT_SCOPES,
-    "urn:neoncloud:projects:create",
-    "urn:neoncloud:projects:read",
-    "urn:neoncloud:projects:update",
-    "urn:neoncloud:projects:delete",
-    "urn:neoncloud:orgs:create",
-    "urn:neoncloud:orgs:read",
-    "urn:neoncloud:orgs:update",
-    "urn:neoncloud:orgs:delete",
-    "urn:neoncloud:orgs:permission",
+	...ALWAYS_PRESENT_SCOPES,
+	"urn:neoncloud:projects:create",
+	"urn:neoncloud:projects:read",
+	"urn:neoncloud:projects:update",
+	"urn:neoncloud:projects:delete",
+	"urn:neoncloud:orgs:create",
+	"urn:neoncloud:orgs:read",
+	"urn:neoncloud:orgs:update",
+	"urn:neoncloud:orgs:delete",
+	"urn:neoncloud:orgs:permission"
 ];
 const AUTH_TIMEOUT_SECONDS = 60;
-export const defaultClientID = "neonctl";
-export const refreshToken = async ({ oauthHost, clientId, allowUnsafeTls }, tokenSet) => {
-    log.debug("Discovering oauth server");
-    const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: "none" }, client.None(), {
-        timeout: SERVER_TIMEOUT,
-        execute: allowUnsafeTls
-            ? [client.allowInsecureRequests]
-            : undefined,
-    });
-    return await client.refreshTokenGrant(configuration, tokenSet.refresh_token);
+const defaultClientID = "neonctl";
+const refreshToken = async ({ oauthHost, clientId, allowUnsafeTls }, tokenSet) => {
+	log.debug("Discovering oauth server");
+	const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: "none" }, client.None(), {
+		timeout: SERVER_TIMEOUT,
+		execute: allowUnsafeTls ? [client.allowInsecureRequests] : void 0
+	});
+	return await client.refreshTokenGrant(configuration, tokenSet.refresh_token);
 };
 /**
- * Invalidate a refresh token at the authorization server (RFC 7009).
- *
- * Best-effort by design, and it returns a boolean rather than throwing: the usual reason to
- * revoke is that a profile is being removed, and a revoke that fails — offline, token
- * already dead, server unreachable — must not leave the local entry stranded. Deleting the
- * file alone would only stop *us* using the token; this stops anyone.
- */
-export const revokeToken = async ({ oauthHost, clientId, allowUnsafeTls }, tokenSet) => {
-    const token = tokenSet.refresh_token;
-    if (typeof token !== "string" || token === "")
-        return false;
-    try {
-        const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: "none" }, client.None(), {
-            timeout: SERVER_TIMEOUT,
-            execute: allowUnsafeTls
-                ? [client.allowInsecureRequests]
-                : undefined,
-        });
-        await client.tokenRevocation(configuration, token, {
-            token_type_hint: "refresh_token",
-        });
-        return true;
-    }
-    catch (err) {
-        log.debug("Token revocation failed: %s", err instanceof Error ? err.message : String(err));
-        return false;
-    }
+* Invalidate a refresh token at the authorization server (RFC 7009).
+*
+* Best-effort by design, and it returns a boolean rather than throwing: the usual reason to
+* revoke is that a profile is being removed, and a revoke that fails — offline, token
+* already dead, server unreachable — must not leave the local entry stranded. Deleting the
+* file alone would only stop *us* using the token; this stops anyone.
+*/
+const revokeToken = async ({ oauthHost, clientId, allowUnsafeTls }, tokenSet) => {
+	const token = tokenSet.refresh_token;
+	if (typeof token !== "string" || token === "") return false;
+	try {
+		const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: "none" }, client.None(), {
+			timeout: SERVER_TIMEOUT,
+			execute: allowUnsafeTls ? [client.allowInsecureRequests] : void 0
+		});
+		await client.tokenRevocation(configuration, token, { token_type_hint: "refresh_token" });
+		return true;
+	} catch (err) {
+		log.debug("Token revocation failed: %s", err instanceof Error ? err.message : String(err));
+		return false;
+	}
 };
-export const auth = async ({ oauthHost, clientId, allowUnsafeTls, }) => {
-    log.debug("Discovering oauth server");
-    const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: "none" }, client.None(), {
-        timeout: SERVER_TIMEOUT,
-        execute: allowUnsafeTls
-            ? [client.allowInsecureRequests]
-            : undefined,
-    });
-    //
-    // Start HTTP server and wait till /callback is hit
-    //
-    log.debug("Starting HTTP Server for callback");
-    const server = createServer();
-    server.listen(0, "127.0.0.1", function () {
-        log.debug(`Listening on port ${this.address().port}`);
-    });
-    await new Promise((resolve) => server.once("listening", resolve));
-    const listen_port = server.address().port;
-    // https://datatracker.ietf.org/doc/html/rfc6819#section-4.4.1.8
-    const state = client.randomState();
-    // we store the code_verifier in memory
-    const codeVerifier = client.randomPKCECodeVerifier();
-    const codeChallenge = await client.calculatePKCECodeChallenge(codeVerifier);
-    return new Promise((resolve, reject) => {
-        const timer = setTimeout(() => {
-            reject(new Error(`Authentication timed out after ${AUTH_TIMEOUT_SECONDS} seconds`));
-        }, AUTH_TIMEOUT_SECONDS * 1000);
-        const onRequest = async (request, response) => {
-            //
-            // Wait for callback and follow oauth flow.
-            //
-            if (!request.url?.startsWith("/callback")) {
-                response.writeHead(404);
-                response.end();
-                return;
-            }
-            // process the CORS preflight OPTIONS request
-            if (request.method === "OPTIONS") {
-                response.writeHead(200, {
-                    "Access-Control-Allow-Origin": "*",
-                    "Access-Control-Allow-Methods": "GET, POST",
-                    "Access-Control-Allow-Headers": "Content-Type",
-                });
-                response.end();
-                return;
-            }
-            log.debug(`Callback received: ${request.url}`);
-            const tokenSet = await client.authorizationCodeGrant(configuration, new URL(request.url, `http://127.0.0.1:${listen_port}`), {
-                pkceCodeVerifier: codeVerifier,
-                expectedState: state,
-            });
-            response.writeHead(200, { "Content-Type": "text/html" });
-            createReadStream(join(fileURLToPath(new URL(".", import.meta.url)), "./callback.html")).pipe(response);
-            clearTimeout(timer);
-            const exp = new Date();
-            exp.setSeconds(exp.getSeconds() + (tokenSet.expires_in ?? 0));
-            resolve(extendTokenSet(tokenSet));
-            server.close();
-        };
-        server.on("request", (req, res) => {
-            void onRequest(req, res);
-        });
-        //
-        // Open browser to let user authenticate
-        //
-        const scopes = clientId == defaultClientID
-            ? NEONCTL_SCOPES
-            : ALWAYS_PRESENT_SCOPES;
-        const authUrl = client.buildAuthorizationUrl(configuration, {
-            scope: scopes.join(" "),
-            state,
-            code_challenge: codeChallenge,
-            code_challenge_method: "S256",
-            redirect_uri: REDIRECT_URI(listen_port),
-        });
-        log.info("Awaiting authentication in web browser.");
-        log.info(`Auth Url: ${authUrl}`);
-        open(authUrl.href).catch((err) => {
-            const msg = `Failed to open web browser. Please copy & paste auth url to authenticate in browser.`;
-            const typedErr = err && err instanceof Error ? err : undefined;
-            sendError(typedErr || new Error(msg), matchErrorCode(msg));
-            log.error(msg);
-        });
-    });
+const auth = async ({ oauthHost, clientId, allowUnsafeTls }) => {
+	log.debug("Discovering oauth server");
+	const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: "none" }, client.None(), {
+		timeout: SERVER_TIMEOUT,
+		execute: allowUnsafeTls ? [client.allowInsecureRequests] : void 0
+	});
+	log.debug("Starting HTTP Server for callback");
+	const server = createServer();
+	server.listen(0, "127.0.0.1", function() {
+		log.debug(`Listening on port ${this.address().port}`);
+	});
+	await new Promise((resolve) => server.once("listening", resolve));
+	const listen_port = server.address().port;
+	const state = client.randomState();
+	const codeVerifier = client.randomPKCECodeVerifier();
+	const codeChallenge = await client.calculatePKCECodeChallenge(codeVerifier);
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => {
+			reject(/* @__PURE__ */ new Error(`Authentication timed out after ${AUTH_TIMEOUT_SECONDS} seconds`));
+		}, AUTH_TIMEOUT_SECONDS * 1e3);
+		const onRequest = async (request, response) => {
+			if (!request.url?.startsWith("/callback")) {
+				response.writeHead(404);
+				response.end();
+				return;
+			}
+			if (request.method === "OPTIONS") {
+				response.writeHead(200, {
+					"Access-Control-Allow-Origin": "*",
+					"Access-Control-Allow-Methods": "GET, POST",
+					"Access-Control-Allow-Headers": "Content-Type"
+				});
+				response.end();
+				return;
+			}
+			log.debug(`Callback received: ${request.url}`);
+			const tokenSet = await client.authorizationCodeGrant(configuration, new URL(request.url, `http://127.0.0.1:${listen_port}`), {
+				pkceCodeVerifier: codeVerifier,
+				expectedState: state
+			});
+			response.writeHead(200, { "Content-Type": "text/html" });
+			createReadStream(join(fileURLToPath(new URL(".", import.meta.url)), "./callback.html")).pipe(response);
+			clearTimeout(timer);
+			const exp = /* @__PURE__ */ new Date();
+			exp.setSeconds(exp.getSeconds() + (tokenSet.expires_in ?? 0));
+			resolve(extendTokenSet(tokenSet));
+			server.close();
+		};
+		server.on("request", (req, res) => {
+			onRequest(req, res);
+		});
+		const scopes = clientId == "neonctl" ? NEONCTL_SCOPES : ALWAYS_PRESENT_SCOPES;
+		const authUrl = client.buildAuthorizationUrl(configuration, {
+			scope: scopes.join(" "),
+			state,
+			code_challenge: codeChallenge,
+			code_challenge_method: "S256",
+			redirect_uri: REDIRECT_URI(listen_port)
+		});
+		log.info("Awaiting authentication in web browser.");
+		log.info(`Auth Url: ${authUrl}`);
+		open(authUrl.href).catch((err) => {
+			const msg = `Failed to open web browser. Please copy & paste auth url to authenticate in browser.`;
+			const typedErr = err && err instanceof Error ? err : void 0;
+			sendError(typedErr || new Error(msg), matchErrorCode(msg));
+			log.error(msg);
+		});
+	});
 };
+//#endregion
+export { auth, defaultClientID, refreshToken, revokeToken };

package/dist/auth_context.js

@@ -1,61 +1,47 @@
-import { isOwnedCredentialPath } from "./config.js";
+import { isOwnedCredentialPath } from "./_shared/paths.js";
+import "./config.js";
+//#region src/auth_context.ts
 let current = null;
-export const setAuthContext = (context) => {
-    current = context;
+const setAuthContext = (context) => {
+	current = context;
 };
-export const getAuthContext = () => current;
+const getAuthContext = () => current;
 /** Reset between tests, so one case cannot observe another's authentication. */
-export const clearAuthContext = () => {
-    current = null;
+const clearAuthContext = () => {
+	current = null;
 };
 /**
- * The credentials file a 401 should delete, or `null` to leave everything on disk.
- *
- * Only an expired OAuth token set is worth clearing: deleting it makes the next command log
- * in again, which is the recovery. Neither key-shaped source is.
- *
- * A key passed on the command line was never ours to store, so a 401 on it says nothing about
- * any stored credential — clearing one would sign the user out of an account the failed
- * request never used.
- *
- * A key read from a profile must survive for a sharper reason: unlike an OAuth token there is
- * nothing to refresh and no automatic way back, so deleting it would destroy the only copy of
- * a credential the user has to paste or mint again. It is also the expected state during
- * rotation, where the whole point is that the old key is dead and the file must still be there
- * to be replaced.
- */
-export const credentialsToClearOn401 = (context) => {
-    if (context?.source !== "stored-credentials")
-        return null;
-    const path = context.credentialsPath;
-    if (path === undefined)
-        return null;
-    // Only a file the CLI created. A profile entry may point anywhere, and a credentials file
-    // we merely adopted is not ours to delete — `neon profile remove` already refuses to touch
-    // one, so a 401 must not quietly do what an explicit removal declines to.
-    //
-    // The legacy `neonctl` directory counts as ours: default resolution deliberately still
-    // reads it in place, so an install predating the rename would otherwise have its own
-    // credentials called "adopted" and never cleared.
-    return isOwnedCredentialPath(context.configDir, path) ? path : null;
+* The credentials file a 401 should delete, or `null` to leave everything on disk.
+*
+* Only an expired OAuth token set is worth clearing: deleting it makes the next command log
+* in again, which is the recovery. Neither key-shaped source is.
+*
+* A key passed on the command line was never ours to store, so a 401 on it says nothing about
+* any stored credential — clearing one would sign the user out of an account the failed
+* request never used.
+*
+* A key read from a profile must survive for a sharper reason: unlike an OAuth token there is
+* nothing to refresh and no automatic way back, so deleting it would destroy the only copy of
+* a credential the user has to paste or mint again. It is also the expected state during
+* rotation, where the whole point is that the old key is dead and the file must still be there
+* to be replaced.
+*/
+const credentialsToClearOn401 = (context) => {
+	if (context?.source !== "stored-credentials") return null;
+	const path = context.credentialsPath;
+	if (path === void 0) return null;
+	return isOwnedCredentialPath(context.configDir, path) ? path : null;
 };
 /**
- * What to tell the user when the API rejects their credential, naming the profile and file
- * when one is involved so they know which of several accounts failed and what to re-run.
- */
-export const authFailureMessage = (context) => {
-    const profile = context?.profile ?? "the selected profile";
-    const where = context?.credentialsPath !== undefined
-        ? ` (${context.credentialsPath})`
-        : "";
-    if (context?.source === "profile-api-key") {
-        // Not `rotate-key`: a rejected key cannot authenticate to mint its own replacement.
-        return `Authentication failed: the Neon API rejected profile "${profile}"'s API key${where}. Replace it with \`neon profile create ${profile} --mint --force\`, or store another with \`neon profile create ${profile} --api-key - --force\`.`;
-    }
-    // Reached only when the session was not ours to clear, i.e. an adopted credentials file.
-    // Saying "check --api-key" there would be nonsense; the fix is to sign in again.
-    if (context?.source === "stored-credentials") {
-        return `Authentication failed: the Neon API rejected profile "${profile}"'s stored session${where}. That file was not created by neon, so it was left alone — sign in again with \`neon auth --profile ${profile}\`.`;
-    }
-    return "Authentication failed: the Neon API rejected the API key. Check --api-key or NEON_API_KEY.";
+* What to tell the user when the API rejects their credential, naming the profile and file
+* when one is involved so they know which of several accounts failed and what to re-run.
+*/
+const authFailureMessage = (context) => {
+	const profile = context?.profile ?? "the selected profile";
+	const where = context?.credentialsPath !== void 0 ? ` (${context.credentialsPath})` : "";
+	if (context?.source === "profile-api-key") return `Authentication failed: the Neon API rejected profile "${profile}"'s API key${where}. Replace it with \`neon profile create ${profile} --mint --force\`, or store another with \`neon profile create ${profile} --api-key - --force\`.`;
+	if (context?.source === "stored-credentials") return `Authentication failed: the Neon API rejected profile "${profile}"'s stored session${where}. That file was not created by neon, so it was left alone — sign in again with \`neon auth --profile ${profile}\`.`;
+	return "Authentication failed: the Neon API rejected the API key. Check --api-key or NEON_API_KEY.";
 };
+//#endregion
+export { authFailureMessage, clearAuthContext, credentialsToClearOn401, getAuthContext, setAuthContext };

package/dist/cli.js

@@ -1,9 +1,6 @@
 #!/usr/bin/env node
 import { tryCurrentBranchFastPath } from "./current_branch_fast_path.js";
-// Fast path for the offline `(config) status --current-branch` probe (used by shell
-// prompts): read the pinned branch from `.neon` without loading the full command tree,
-// api-client, and yargs (~200ms). Falls through to the full CLI for everything else, so
-// the heavy `index.js` is imported lazily and only when actually needed.
-if (!tryCurrentBranchFastPath(process.argv)) {
-    void import("./index.js");
-}
+//#region src/cli.ts
+if (!tryCurrentBranchFastPath(process.argv)) import("./index.js");
+//#endregion
+export {};