orizu 0.5.24 → 0.5.26

package/dist/http.js

@@ -1,5 +1,6 @@
-import { getActiveBaseUrl, getServerCredentials, resolveEnvBearerToken, updateServerCredentials, } from './credentials.js';
+import { clearServerCredentialsIfCurrent, credentialsEqual, getActiveBaseUrl, getServerCredentials, resolveEnvBearerToken, updateServerCredentialsIfCurrent, withCredentialsTransactionLockAsync, } from './credentials.js';
 import { getFlagBaseUrl, normalizeBaseUrl } from './global-flags.js';
+import { describeLogoutHttpFailure, describeLogoutTransportFailure, } from './logout-diagnostic.js';
 let runtimeFlags = { local: false, server: null };
 export function setGlobalFlags(flags) {
     runtimeFlags = flags;
@@ -65,24 +66,79 @@ function isExpired(expiresAt) {
     const nowUnix = Math.floor(Date.now() / 1000);
     return expiresAt <= nowUnix + 30;
 }
+const DEFAULT_CREDENTIALS_REFRESH_TIMEOUT_MS = 10_000;
+const MAX_CREDENTIALS_REFRESH_TIMEOUT_MS = 30_000;
+const DEFAULT_LOGOUT_TIMEOUT_MS = 10_000;
+const MAX_LOGOUT_TIMEOUT_MS = 30_000;
+function getCredentialsRefreshTimeoutMs() {
+    const configured = Number(process.env.ORIZU_CREDENTIALS_REFRESH_TIMEOUT_MS);
+    if (!Number.isSafeInteger(configured) || configured <= 0) {
+        return DEFAULT_CREDENTIALS_REFRESH_TIMEOUT_MS;
+    }
+    return Math.min(configured, MAX_CREDENTIALS_REFRESH_TIMEOUT_MS);
+}
+function getLogoutTimeoutMs() {
+    const configured = Number(process.env.ORIZU_LOGOUT_TIMEOUT_MS);
+    if (!Number.isSafeInteger(configured) || configured <= 0) {
+        return DEFAULT_LOGOUT_TIMEOUT_MS;
+    }
+    return Math.min(configured, MAX_LOGOUT_TIMEOUT_MS);
+}
+async function withAbortDeadline(operation, callerSignal, timeoutMs, timeoutError) {
+    const controller = new AbortController();
+    const handleCallerAbort = () => controller.abort(callerSignal?.reason);
+    if (callerSignal?.aborted)
+        handleCallerAbort();
+    else
+        callerSignal?.addEventListener('abort', handleCallerAbort, { once: true });
+    const timer = setTimeout(() => controller.abort(timeoutError), timeoutMs);
+    const cancellation = new Promise((_resolve, reject) => {
+        const handleAbort = () => reject(controller.signal.reason ?? new Error('Request aborted.'));
+        if (controller.signal.aborted)
+            handleAbort();
+        else
+            controller.signal.addEventListener('abort', handleAbort, { once: true });
+    });
+    try {
+        return await Promise.race([operation(controller.signal), cancellation]);
+    }
+    finally {
+        clearTimeout(timer);
+        callerSignal?.removeEventListener('abort', handleCallerAbort);
+    }
+}
+async function withCredentialsRefreshDeadline(operation, callerSignal) {
+    const timeoutMs = getCredentialsRefreshTimeoutMs();
+    const timeoutError = new Error(`ORIZU_CREDENTIALS_REFRESH_TIMEOUT: session refresh exceeded ${timeoutMs}ms.`);
+    return await withAbortDeadline(operation, callerSignal, timeoutMs, timeoutError);
+}
+async function withLogoutDeadline(operation, callerSignal) {
+    const timeoutMs = getLogoutTimeoutMs();
+    const timeoutError = new Error(`ORIZU_LOGOUT_TIMEOUT: remote logout exceeded ${timeoutMs}ms.`);
+    timeoutError.name = 'TimeoutError';
+    return await withAbortDeadline(operation, callerSignal, timeoutMs, timeoutError);
+}
 export function credentialRequestRedirectPolicy() {
     return process.env.ORIZU_CLI_AUTH_REDIRECT === 'error' ? { redirect: 'error' } : {};
 }
-async function refreshCredentials(baseUrl, credentials) {
+async function refreshCredentials(baseUrl, credentials, callerSignal) {
     if (!isSessionCredentials(credentials)) {
         throw new Error('API key credentials do not refresh. Run `orizu login` again if access fails.');
     }
     assertSecureTokenTransport(baseUrl);
-    const response = await fetch(`${baseUrl}/api/cli/auth/refresh`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ refreshToken: credentials.refreshToken }),
-        ...credentialRequestRedirectPolicy(),
-    });
-    if (!response.ok) {
-        throw new Error('Session expired. Run `orizu login` again.');
-    }
-    const data = await response.json();
+    const data = await withCredentialsRefreshDeadline(async (signal) => {
+        const response = await fetch(`${baseUrl}/api/cli/auth/refresh`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ refreshToken: credentials.refreshToken }),
+            ...credentialRequestRedirectPolicy(),
+            signal,
+        });
+        if (!response.ok) {
+            throw new Error('Session expired. Run `orizu login` again.');
+        }
+        return await response.json();
+    }, callerSignal);
     if (!data.accessToken || !data.refreshToken || !data.expiresAt) {
         throw new Error('Server returned invalid refresh credentials. Run `orizu login` again.');
     }
@@ -92,9 +148,169 @@ async function refreshCredentials(baseUrl, credentials) {
         refreshToken: data.refreshToken,
         expiresAt: data.expiresAt,
     };
-    updateServerCredentials(baseUrl, refreshed);
+    if (isExpired(refreshed.expiresAt)) {
+        throw new Error('ORIZU_CREDENTIALS_REFRESH_UNUSABLE: refreshed session expires within the 30-second safety window.');
+    }
     return refreshed;
 }
+async function refreshStoredCredentialsIfCurrent(baseUrl, expected, callerSignal) {
+    return await withCredentialsTransactionLockAsync(async () => {
+        const current = getServerCredentials(baseUrl);
+        if (!current || !credentialsEqual(current, expected)) {
+            return { status: 'changed', credentials: current };
+        }
+        const refreshed = await refreshCredentials(baseUrl, expected, callerSignal);
+        if (!updateServerCredentialsIfCurrent(baseUrl, expected, refreshed)) {
+            return { status: 'changed', credentials: getServerCredentials(baseUrl) };
+        }
+        return { status: 'refreshed', credentials: refreshed };
+    });
+}
+function requireCurrentCredentials(baseUrl, credentials) {
+    if (credentials)
+        return credentials;
+    throw new Error(`Not logged in for ${baseUrl}. Run \`orizu login --server ${baseUrl}\` (or \`--local\`) first.`);
+}
+async function refreshExpiredStoredCredentials(baseUrl, initial, callerSignal) {
+    if (!isSessionCredentials(initial) || !isExpired(initial.expiresAt)) {
+        return { credentials: initial, didRefresh: false };
+    }
+    const result = await refreshStoredCredentialsIfCurrent(baseUrl, initial, callerSignal);
+    if (result.status === 'changed') {
+        throw new Error('ORIZU_AUTH_CONTEXT_CHANGED: stored credentials changed before this request began; the request was not sent.');
+    }
+    return {
+        credentials: requireCurrentCredentials(baseUrl, result.credentials),
+        didRefresh: true,
+    };
+}
+/**
+ * Captures one authenticated server context for a multi-step operation. The
+ * returned interface intentionally exposes no credential material: its closure
+ * pins the selected origin and bearer/session so later global config changes
+ * cannot move an in-flight operation to another account.
+ */
+export function captureAuthenticatedRequestContext(options = {}) {
+    const baseUrl = resolveBaseUrl();
+    const allowRefresh = options.allowRefresh ?? true;
+    assertSecureTokenTransport(baseUrl);
+    const envBearer = resolveEnvBearerToken();
+    if (envBearer) {
+        const explicitBearer = process.env.ORIZU_TOKEN?.trim() || null;
+        const source = explicitBearer
+            ? 'ORIZU_TOKEN'
+            : 'ORIZU_TOKEN_FILE';
+        const resolveRequestBearer = () => {
+            if (explicitBearer)
+                return explicitBearer;
+            try {
+                const currentBearer = resolveEnvBearerToken();
+                if (currentBearer)
+                    return currentBearer;
+            }
+            catch (error) {
+                const detail = error instanceof Error ? error.message : String(error);
+                throw new Error(`${detail} Fix, rotate, or unset ORIZU_TOKEN_FILE and rerun \`orizu setup\`.`);
+            }
+            throw new Error('ORIZU_TOKEN_FILE no longer supplies a token. Fix, rotate, or unset ORIZU_TOKEN_FILE and rerun `orizu setup`.');
+        };
+        return {
+            baseUrl,
+            source,
+            async fetch(path, init = {}) {
+                return await fetch(`${baseUrl}${path}`, {
+                    ...init,
+                    headers: {
+                        ...(init.headers || {}),
+                        Authorization: `Bearer ${resolveRequestBearer()}`,
+                    },
+                    ...credentialRequestRedirectPolicy(),
+                });
+            },
+            async logout() {
+                throw new Error(`Authentication is supplied by ${source}; stored logout is unavailable.`);
+            },
+        };
+    }
+    const capturedCredentials = getServerCredentials(baseUrl);
+    if (!capturedCredentials) {
+        throw new Error(`Not logged in for ${baseUrl}. Run \`orizu login --server ${baseUrl}\` (or \`--local\`) first.`);
+    }
+    let activeCredentials = capturedCredentials;
+    async function refreshCapturedCredentials(callerSignal) {
+        const result = await refreshStoredCredentialsIfCurrent(baseUrl, activeCredentials, callerSignal);
+        if (result.status === 'changed') {
+            throw new Error('ORIZU_CREDENTIALS_CHANGED: stored credentials changed before the captured session could refresh. Reconfirm the account and retry.');
+        }
+        activeCredentials = requireCurrentCredentials(baseUrl, result.credentials);
+    }
+    return {
+        baseUrl,
+        source: 'stored',
+        async fetch(path, init = {}) {
+            let didRefresh = false;
+            if (allowRefresh
+                && isSessionCredentials(activeCredentials)
+                && isExpired(activeCredentials.expiresAt)) {
+                await refreshCapturedCredentials(init.signal);
+                didRefresh = true;
+            }
+            let response = await fetch(`${baseUrl}${path}`, {
+                ...init,
+                headers: {
+                    ...(init.headers || {}),
+                    Authorization: `Bearer ${getAuthorizationToken(activeCredentials)}`,
+                },
+                ...credentialRequestRedirectPolicy(),
+            });
+            if (allowRefresh
+                && response.status === 401
+                && isSessionCredentials(activeCredentials)
+                && !didRefresh) {
+                await refreshCapturedCredentials(init.signal);
+                response = await fetch(`${baseUrl}${path}`, {
+                    ...init,
+                    headers: {
+                        ...(init.headers || {}),
+                        Authorization: `Bearer ${getAuthorizationToken(activeCredentials)}`,
+                    },
+                    ...credentialRequestRedirectPolicy(),
+                });
+            }
+            return response;
+        },
+        async logout(callerSignal) {
+            const authorizationToken = getAuthorizationToken(activeCredentials);
+            const secrets = [
+                authorizationToken,
+                ...(isSessionCredentials(activeCredentials) ? [activeCredentials.refreshToken] : []),
+            ];
+            let remoteLogoutReason = null;
+            try {
+                remoteLogoutReason = await withLogoutDeadline(async (signal) => {
+                    const response = await fetch(`${baseUrl}/api/cli/auth/logout`, {
+                        method: 'POST',
+                        headers: {
+                            'Content-Type': 'application/json',
+                            Authorization: `Bearer ${authorizationToken}`,
+                        },
+                        body: isSessionCredentials(activeCredentials)
+                            ? JSON.stringify({ refreshToken: activeCredentials.refreshToken })
+                            : undefined,
+                        ...credentialRequestRedirectPolicy(),
+                        signal,
+                    });
+                    return response.ok ? null : await describeLogoutHttpFailure(response, secrets);
+                }, callerSignal);
+            }
+            catch (error) {
+                remoteLogoutReason = describeLogoutTransportFailure(error, secrets);
+            }
+            const localCredentialCleared = clearServerCredentialsIfCurrent(baseUrl, activeCredentials);
+            return { remoteError: remoteLogoutReason, localCredentialCleared };
+        },
+    };
+}
 export async function authedFetch(path, init = {}) {
     const baseUrl = resolveBaseUrl();
     assertSecureTokenTransport(baseUrl);
@@ -118,10 +334,8 @@ export async function authedFetch(path, init = {}) {
     if (!credentials) {
         throw new Error(`Not logged in for ${baseUrl}. Run \`orizu login --server ${baseUrl}\` (or \`--local\`) first.`);
     }
-    let activeCredentials = credentials;
-    if (isSessionCredentials(activeCredentials) && isExpired(activeCredentials.expiresAt)) {
-        activeCredentials = await refreshCredentials(baseUrl, activeCredentials);
-    }
+    const resolved = await refreshExpiredStoredCredentials(baseUrl, credentials, init.signal);
+    let activeCredentials = resolved.credentials;
     let response = await fetch(`${baseUrl}${path}`, {
         ...init,
         headers: {
@@ -130,8 +344,14 @@ export async function authedFetch(path, init = {}) {
         },
         ...credentialRequestRedirectPolicy(),
     });
-    if (response.status === 401 && isSessionCredentials(activeCredentials)) {
-        activeCredentials = await refreshCredentials(baseUrl, activeCredentials);
+    if (response.status === 401
+        && isSessionCredentials(activeCredentials)
+        && !resolved.didRefresh) {
+        const refreshResult = await refreshStoredCredentialsIfCurrent(baseUrl, activeCredentials, init.signal);
+        if (refreshResult.status === 'changed') {
+            throw new Error('ORIZU_AUTH_CONTEXT_CHANGED: stored credentials changed after this request began; the request was not replayed.');
+        }
+        activeCredentials = requireCurrentCredentials(baseUrl, refreshResult.credentials);
         response = await fetch(`${baseUrl}${path}`, {
             ...init,
             headers: {

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAuGgF,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAoChJ,eAAO,MAAM,wBAAwB,GAAI,iBAAiB,MAAM;;;EACJ,CAAA;AAE5D,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAgU5E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAUD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOnD;AAyBD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAsBD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,GAAG,CAqB5E;AA6BD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgBtD;AAylKD,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CA0B1G;AAED,eAAO,MAAM,iBAAiB,SAAU,CAAA;AACxC,eAAO,MAAM,uBAAuB,QAAkB,CAAA;AACtD,eAAO,MAAM,oBAAoB,aAgB/B,CAAA;AAEF,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAaxH;AAmMD,wBAAsB,IAAI,CAAC,OAAO,WAAwB,iBAwgBzD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAwHgF,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAoChJ,eAAO,MAAM,wBAAwB,GAAI,iBAAiB,MAAM;;;EACJ,CAAA;AAE5D,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAgU5E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAUD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOnD;AAyBD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAsBD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,GAAG,CAqB5E;AA6BD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgBtD;AAk/JD,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CA0B1G;AAED,eAAO,MAAM,iBAAiB,SAAU,CAAA;AACxC,eAAO,MAAM,uBAAuB,QAAkB,CAAA;AACtD,eAAO,MAAM,oBAAoB,aAgB/B,CAAA;AAEF,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAaxH;AAmMD,wBAAsB,IAAI,CAAC,OAAO,WAAwB,iBAwgBzD"}