ovsx 1.3.0 → 1.4.0

package/src/publish.ts

@@ -35,24 +35,68 @@ export async function publish(options: PublishOptions = {}): Promise<PromiseSett
     addEnvOptions(options);
     addTrustedPublishingEnvOptions(options);
 
+    const internalPublishOptions: InternalPublishOptions[] = [];
+    const prepackagedFiles: string[] = [];
+    const packagePaths = options.packagePath || [undefined];
+    const targets = options.targets || [undefined];
+    for (const packagePath of packagePaths) {
+        const extensionFile = options.extensionFile ?? (packagePath?.endsWith('.vsix') ? packagePath : undefined);
+        if (extensionFile !== undefined) {
+            prepackagedFiles.push(extensionFile);
+            // A package is already built for its target, so it is published once, not once per target.
+            internalPublishOptions.push({ ...options, extensionFile, packagePath: undefined, target: undefined });
+        } else {
+            for (const target of targets) {
+                internalPublishOptions.push({ ...options, packagePath, target });
+            }
+        }
+    }
+    // Before the registry is contacted, so a slow or failing lookup cannot keep these from being seen.
+    warnIgnoredPackagingOptions(options, prepackagedFiles);
+
     // Shared by every target/package below, rather than one per artifact: besides saving the extra
     // `/api/version` round trips, it's also where the registry's reported version is cached (see
     // Registry.tokenQuery), so a wide fan-out doesn't repeat that lookup once per target either.
     const registry = new Registry(options);
     const maxExtensionSize = await getMaxExtensionSize(registry);
 
-    const internalPublishOptions: InternalPublishOptions[] = [];
-    const packagePaths = options.packagePath || [undefined];
-    const targets = options.targets || [undefined];
-    for (const packagePath of packagePaths) {
-        for (const target of targets) {
-            internalPublishOptions.push({ ...options, packagePath: packagePath, target: target, maxExtensionSize });
+    return Promise.allSettled(internalPublishOptions.map(publishOptions =>
+        doPublish(registry, { ...publishOptions, maxExtensionSize })));
+}
+
+/**
+ * Names the files in the warning: next to a directory being packaged, the options still apply to that.
+ */
+function warnIgnoredPackagingOptions(options: PublishOptions, prepackagedFiles: string[]): void {
+    const files = [...new Set(prepackagedFiles)];
+    if (files.length === 0) {
+        return;
+    }
+    const subject = `${files.length === 1 ? 'extension' : 'extensions'} ${files.map(file => `'${file}'`).join(', ')}`;
+    for (const [flag, key] of PACKAGING_OPTIONS) {
+        // An explicit `false` is not a flag that was given.
+        if (options[key] !== undefined && options[key] !== false) {
+            console.warn(`Ignoring option '${flag}' for prepackaged ${subject}.`);
         }
     }
-
-    return Promise.allSettled(internalPublishOptions.map(publishOptions => doPublish(registry, publishOptions)));
 }
 
+/**
+ * Options that only affect packaging, with the CLI flag that sets each, in the order they are reported
+ * as ignored for a prepackaged extension. `--no-dependencies` is left out: the CLI always sets
+ * `dependencies`, so whether it was given cannot be told apart.
+ */
+export const PACKAGING_OPTIONS: ReadonlyArray<readonly [string, keyof PublishOptions]> = [
+    ['--target', 'targets'],
+    ['--baseContentUrl', 'baseContentUrl'],
+    ['--baseImagesUrl', 'baseImagesUrl'],
+    ['--yarn', 'yarn'],
+    ['--follow-symlinks', 'followSymlinks'],
+    ['--packageVersion', 'packageVersion'],
+    ['--allow-missing-repository', 'allowMissingRepository'],
+    ['--pre-release', 'preRelease']
+];
+
 /**
  * Looks up the registry's default extension size limit, so an oversized package can be flagged
  * before the upload instead of after transferring the whole payload.
@@ -69,20 +113,12 @@ async function getMaxExtensionSize(registry: Registry): Promise<number | undefin
 }
 
 async function doPublish(registry: Registry, options: InternalPublishOptions = {}): Promise<void> {
-    // if the packagePath is a link to a vsix, don't need to package it
-    if (options.packagePath?.endsWith('.vsix')) {
-        options.extensionFile = options.packagePath;
-        delete options.packagePath;
-        delete options.target;
-    }
     // Only a package created here is a temp file; one the user supplied must never be deleted.
     const packaged = !options.extensionFile;
     try {
         if (packaged) {
             await packageExtension(options, registry);
             console.log(); // new line
-        } else if (options.preRelease) {
-            console.warn("Ignoring option '--pre-release' for prepackaged extension.");
         }
         await publishExtensionFile(registry, options);
     } finally {
@@ -109,7 +145,10 @@ async function publishExtensionFile(registry: Registry, options: InternalPublish
             exchanged = { namespace: manifest.publisher, extension: manifest.name };
             options.pat = await getTrustedPublishingToken(registry, manifest.publisher, manifest.name, options);
         } else {
-            options.pat = await getPAT(manifest.publisher, options);
+            // getPAT has verified a prompted token already, so it can be stored before publishing
+            const { pat, save } = await getPAT(manifest.publisher, options);
+            options.pat = pat;
+            await save();
         }
     }
 
@@ -210,7 +249,8 @@ async function ensureWithinSizeLimit(
         const fallback = options.maxExtensionSize;
         if (fallback && size > fallback) {
             console.warn(
-                `The extension package (${formatBytes(size)}) exceeds the default size limit of ${formatBytes(fallback)} `
+                `The extension package (${formatBytes(size)}, ${size} bytes) exceeds the default size limit of `
+                + `${formatBytes(fallback)} (${fallback} bytes) `
                 + `reported by the registry at ${registry.url}, which is too old to report the limit for a `
                 + `single namespace. Publishing anyway: the namespace may have a different limit configured, `
                 + `and the registry decides.`
@@ -227,7 +267,8 @@ async function ensureWithinSizeLimit(
 
     if (size > limit.limit) {
         throw new Error(
-            `The extension package (${formatBytes(size)}) exceeds the size limit of ${formatBytes(limit.limit)} `
+            `The extension package (${formatBytes(size)}, ${size} bytes) exceeds the size limit of `
+            + `${formatBytes(limit.limit)} (${limit.limit} bytes) `
             + `for ${manifest.publisher}.${manifest.name} at ${registry.url}.`
         );
     }

package/src/registry.ts

@@ -107,12 +107,23 @@ export class Registry {
     }
 
     /**
-     * Cached per `Registry` instance - callers like `tokenQuery` and `unpublish`'s own version check
+     * Cached per `Registry` instance once it has succeeded - callers like `tokenQuery` and `unpublish`'s own version check
      * would otherwise each fetch it separately, doubling the round trip for a single command.
      */
     getRegistryVersion(): Promise<RegistryVersion> {
         try {
-            return this.registryVersion ??= this.getJson(this.getUrl(['api', 'version']));
+            if (this.registryVersion) {
+                return this.registryVersion;
+            }
+            const pending: Promise<RegistryVersion> = this.getJson(this.getUrl(['api', 'version']));
+            this.registryVersion = pending;
+            // A failure is not remembered, so a later caller asks again rather than inheriting it.
+            pending.catch(() => {
+                if (this.registryVersion === pending) {
+                    this.registryVersion = undefined;
+                }
+            });
+            return pending;
         } catch (err) {
             return rejectError(err);
         }
@@ -144,10 +155,15 @@ export class Registry {
         return Math.max(this.maxPublishSize, sizeLimit);
     }
 
-    requestTrustedPublishingToken(namespace: string, extension: string, idToken: string): Promise<AccessToken> {
+    requestTrustedPublishingToken(
+        namespace: string,
+        extension: string,
+        idToken: string,
+        registrationCode?: string
+    ): Promise<AccessToken> {
         try {
             const url = this.getUrl(['api', '-', 'trusted-publishing', 'token']);
-            const request = { namespace, extension, token: idToken };
+            const request = { namespace, extension, token: idToken, registrationCode };
             return this.post(JSON.stringify(request), url, {
                 'Content-Type': 'application/json'
             }, DEFAULT_TOKEN_REQUEST_SIZE);
@@ -291,6 +307,9 @@ export class Registry {
             send(url, this.getRequestOptions(), undefined, response => {
                 if (response.statusCode !== undefined && (response.statusCode < 200 || response.statusCode > 299)) {
                     response.resume();
+                    // Claimed here so a timeout or reset while the error body drains does not run fail().
+                    // Nothing was written yet, so there is nothing to clean up.
+                    failed = true;
                     reject(statusError(response));
                     return;
                 }

package/src/trusted-publishing-options.ts

@@ -27,4 +27,9 @@ export interface TrustedPublishingOptions {
      * the audience the registry expects.
      */
     oidcAudience?: string;
+    /**
+     * The registration code shown when the trusted publisher of a private repository was registered.
+     * Only the first publish needs it: it completes the registration, and the code is used up.
+     */
+    registrationCode?: string;
 }

package/src/trusted-publishing.ts

@@ -13,7 +13,7 @@
 
 import { getIdToken, hasIdTokenSource } from './oidc';
 import { AccessToken, Registry } from './registry';
-import { StatusError } from './util';
+import { StatusError, redactUrl } from './util';
 import { TrustedPublishingOptions } from './trusted-publishing-options';
 
 const tokens = new Map<string, Promise<string>>();
@@ -100,12 +100,13 @@ async function requestToken(
     extension: string,
     options: TrustedPublishingOptions
 ): Promise<string> {
-    const audience = options.oidcAudience ?? registry.url;
+    requireSecureRegistry(registry);
+    const audience = options.oidcAudience ?? await expectedAudience(registry);
     const idToken = await getIdToken(audience, options);
 
     let result: AccessToken;
     try {
-        result = await exchangeWithRetry(registry, namespace, extension, idToken);
+        result = await exchangeWithRetry(registry, namespace, extension, idToken, options.registrationCode);
     } catch (err) {
         throw new Error(`${err.message}\n${registrationHint(registry, namespace, extension)}`);
     }
@@ -125,11 +126,12 @@ async function exchangeWithRetry(
     registry: Registry,
     namespace: string,
     extension: string,
-    idToken: string
+    idToken: string,
+    registrationCode?: string
 ): Promise<AccessToken> {
     for (let attempt = 0; ; attempt++) {
         try {
-            return await registry.requestTrustedPublishingToken(namespace, extension, idToken);
+            return await registry.requestTrustedPublishingToken(namespace, extension, idToken, registrationCode);
         } catch (err) {
             const status = (err as StatusError)?.status;
             if (attempt >= RETRY_DELAYS_MS.length || status === undefined || !RETRYABLE_STATUS.includes(status)) {
@@ -142,6 +144,32 @@ async function exchangeWithRetry(
     }
 }
 
+/**
+ * The ID token is a bearer credential for publishing, and the registry also chooses the audience it
+ * is minted for, so both only travel over https. A loopback registry is exempt, as for a browser's
+ * secure contexts: nothing leaves the machine.
+ */
+function requireSecureRegistry(registry: Registry): void {
+    const { protocol, hostname } = new URL(registry.url);
+    if (protocol === 'https:' || hostname === 'localhost' || hostname === '[::1]' || /^127\./.test(hostname)) {
+        return;
+    }
+    throw new Error(
+        `Trusted publishing sends an ID token to the registry, so the registry URL must use https, `
+        + `but it is ${redactUrl(registry.url)}. Use an https URL, or publish with an access token.`
+    );
+}
+
+/**
+ * The audience a registry validates is its own configuration, defaulting to the URL of its web UI
+ * rather than the API URL this CLI talks to, so it is read from where the registry publishes it.
+ * A registry that reports nothing there is asked for the registry URL.
+ */
+async function expectedAudience(registry: Registry): Promise<string> {
+    const reported = await registry.getRegistryVersion().catch(() => undefined);
+    return reported?.trustedPublishingAudience ?? registry.url;
+}
+
 function registrationHint(registry: Registry, namespace: string, extension: string): string {
     return `Check the trusted publishers registered for '${namespace}.${extension}' at `
         + `${registry.url}/user-settings/trusted-publishers.`;

package/src/unpublish.ts

@@ -12,12 +12,7 @@
  *****************************************************************************/
 
 import { confirm } from '@inquirer/prompts';
-// `import * as isCI from 'is-ci'` would bind to a namespace object instead of the boolean `is-ci`
-// exports whenever the importer applies ES module interop (e.g. a bundler, or vitest's own
-// transform), making the truthiness check below always true. `import = require` always binds
-// directly to the exported value, regardless of how the importing tool handles interop.
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-import isCI = require('is-ci');
+import { isCI } from 'ci-info';
 import * as semver from 'semver';
 import { getPAT } from './pat';
 import { Registry, TargetPlatformVersion } from './registry';
@@ -48,7 +43,8 @@ export async function unpublish(options: UnpublishOptions = {}): Promise<void> {
     const registry = new Registry(options);
     await ensureUnpublishSupported(registry);
 
-    options.pat = await getPAT(namespace, { ...options, namespace }, false);
+    const { pat, save } = await getPAT(namespace, { ...options, namespace }, false);
+    options.pat = pat;
 
     const targetVersions = getTargetVersions(options);
     await confirmUnpublish(`${namespace}.${extension}`, targetVersions, registry.url, options.force);
@@ -57,6 +53,7 @@ export async function unpublish(options: UnpublishOptions = {}): Promise<void> {
     if (result.error) {
         throw new Error(result.error);
     }
+    await save();
     // the registry reports one line per deleted version, and nothing at all if there was nothing to delete
     console.log(`🗑  ${result.success || `Nothing to delete for ${namespace}.${extension}`}`);
 }

package/src/util.ts

@@ -13,6 +13,7 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 import * as http from 'http';
+import { InvalidArgumentError } from 'commander';
 import { RegistryOptions } from './registry-options';
 import { TrustedPublishingOptions } from './trusted-publishing-options';
 
@@ -28,6 +29,7 @@ export function addTrustedPublishingEnvOptions(options: TrustedPublishingOptions
     options.trustedPublishing ??= parseBooleanEnv(process.env.OVSX_TRUSTED_PUBLISHING);
     options.idToken ??= process.env.OVSX_ID_TOKEN;
     options.oidcAudience ??= process.env.OVSX_OIDC_AUDIENCE;
+    options.registrationCode ??= process.env.OVSX_REGISTRATION_CODE;
 }
 
 /** How long a request may make no progress before it is abandoned; see RegistryOptions.timeout. */
@@ -66,7 +68,8 @@ function parseBooleanEnv(value?: string): boolean | undefined {
 export function parseNonNegativeInt(value: string): number {
     const parsed = Number(value);
     if (!Number.isInteger(parsed) || parsed < 0) {
-        throw new Error(`Expected a non-negative whole number, got '${value}'.`);
+        // Commander prints only this error type as a usage message; anything else escapes as a stack trace.
+        throw new InvalidArgumentError(`Expected a non-negative whole number, got '${value}'.`);
     }
     return parsed;
 }
@@ -137,9 +140,9 @@ export function handleError(debug?: boolean, additionalMessage?: string, exit: b
 }
 
 /**
- * Formats a byte count for display, e.g. `1536` -> `1.5 KB`. Mirrors the registry's own
- * `FileUtils.byteCountToDisplaySize` formatting so client- and server-side size limit messages read
- * the same way.
+ * Formats a byte count for display, rounding down, e.g. `1536` -> `1 KB` and `1048577` -> `1 MB`.
+ * Mirrors the registry's own `FileUtils.byteCountToDisplaySize` formatting so client- and
+ * server-side size limit messages read the same way.
  */
 export function formatBytes(bytes: number): string {
     const units = ['bytes', 'KB', 'MB', 'GB', 'TB', 'PB', 'EB'];

package/src/verify-pat.ts

@@ -33,6 +33,8 @@ export async function verifyPat(options: VerifyPatOptions): Promise<void> {
         }
     }
 
-    options.pat = await getPAT(options.namespace, options, false);
+    const { pat, save } = await getPAT(options.namespace, options, false);
+    options.pat = pat;
     await doVerifyPat(options);
+    await save();
 }