package-registry-manager 0.22.10 → 0.23.0

package/README.md

@@ -35,6 +35,21 @@ one browser, groups npm approvals, and uses CI evidence to preserve healthy toke
 or verify replacements before revocation. `--secret-name '{REGISTRY}_TOKEN_{REPO}'`
 selects custom credential names.
 
+For legacy crates.io consumers, use `setup --org ORG --registry crates-io
+--rotate-token CARGO_TOKEN --execute --browser-import auto`. Rotation preserves
+scopes and GitHub visibility, stores an expiry companion secret, verifies every
+consumer in CI before revocation, and lists migration targets. Ordinary crates.io
+setup uses trusted publishing. `inspect --org ORG --token-expiry-days 7` opens the
+private browser token inventory for advance expiry warnings. See the
+[rotation configuration](../README.md#configuration) for matching and failure behavior.
+
+`setup --org ORG --registry crates-io --migrate --execute --browser-import auto`
+proposes a reviewed conversion of existing jobs and reusable callers. After merging,
+rerun it to register trust, and rerun after a real OIDC release to remove verified
+legacy secrets. Shared organization secrets remain while other consumers exist.
+The same flow supports `--registry npm` and `--registry pypi`; see the
+[migration workflow](../README.md#configuration) for supported layouts and safeguards.
+
 Account scans print progress to stderr (`[37/169] owner/repository`) and stream
 text inspection results as each repository finishes. JSON inspection remains one
 report on stdout. Repository, manifest, registry lookup, and release-log failures are

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "package-registry-manager",
-  "version": "0.22.10",
+  "version": "0.23.0",
   "description": "Inspect repositories and guide secure package-registry setup",
   "type": "module",
   "bin": {
@@ -41,8 +41,8 @@
   },
   "dependencies": {
     "@link-foundation/gh-manager": "https://codeload.github.com/link-foundation/gh-manager/tar.gz/29808e088ac8fd8374361920bbebab07a4d63ac6",
-    "browser-commander": "^0.31.0",
-    "command-stream": "^2.1.0",
+    "browser-commander": "^0.31.2",
+    "command-stream": "^2.4.0",
     "playwright": "^1.63.0",
     "selenium-webdriver": "^4.50.0"
   },

package/src/auth-urls.mjs

@@ -111,6 +111,7 @@ export function runInteractive(command, options) {
       shell: false,
     });
     let legacyLogin = false;
+    let openings = Promise.resolve();
     const stop = options.stopOnLegacyLogin
       ? () => {
           legacyLogin = true;
@@ -119,7 +120,11 @@ export function runInteractive(command, options) {
       : undefined;
     const scan =
       options.onUrl || stop
-        ? authUrlScanner(options.onUrl ?? (() => {}), stop)
+        ? authUrlScanner((url, kind) => {
+            openings = openings.then(() => options.onUrl?.(url, kind));
+            // Observe rejection until the command closes and propagates it.
+            openings.catch(() => {});
+          }, stop)
         : null;
     let stdout = "";
     child.stdout.setEncoding("utf8");
@@ -141,9 +146,20 @@ export function runInteractive(command, options) {
       });
     }
     child.on("error", reject);
-    child.on("close", (code) => {
+    child.on("close", async (code) => {
       scan?.("\n");
-      resolve({ code: code ?? 1, stdout, legacyLogin, approvalExpired });
+      try {
+        await openings;
+        resolve({
+          code: code ?? 1,
+          stdout,
+          stderr: errors,
+          legacyLogin,
+          approvalExpired,
+        });
+      } catch (error) {
+        reject(error);
+      }
     });
   });
 }

package/src/browser.mjs

@@ -74,7 +74,13 @@ export function npmPrefillScript(prefill, submit = false) {
   const config = ${JSON.stringify(prefill)};
   const shouldSubmit = ${JSON.stringify(submit)};
   const normalized = value => (value || '').replace(/\\s+/g, ' ').trim().toLowerCase();
-  const controls = Array.from(document.querySelectorAll('input, select, textarea'));
+  const provider = Array.from(document.querySelectorAll('button, label, [role="radio"]'))
+    .find(element => normalized(element.textContent) === 'github');
+  if (provider) provider.click();
+  const githubForm = document.querySelector('#pending-github-publisher-form, #github-publisher-form');
+  const controls = Array.from((githubForm || document).querySelectorAll('input, select, textarea'))
+    .filter(control => !control.disabled && control.type !== 'hidden'
+      && (githubForm || control.getClientRects().length > 0));
   const setValue = (control, value) => {
     const prototype = control instanceof HTMLSelectElement
       ? HTMLSelectElement.prototype
@@ -88,7 +94,7 @@ export function npmPrefillScript(prefill, submit = false) {
   };
   const textFor = control => {
     const explicit = control.id
-      ? document.querySelector(\`label[for="\${CSS.escape(control.id)}"]\`)?.textContent
+      ? (control.closest('form') || document).querySelector(\`label[for="\${CSS.escape(control.id)}"]\`)?.textContent
       : '';
     return normalized([explicit, control.getAttribute('aria-label'), control.name,
       control.placeholder, control.closest('label')?.textContent].filter(Boolean).join(' '));
@@ -103,19 +109,18 @@ export function npmPrefillScript(prefill, submit = false) {
   const filled = [];
   const used = new Set();
   for (const [labels, value] of values) {
-    if (!value) continue;
+    if (!value && labels[0] !== 'environment') continue;
     const control = controls.find(candidate => !used.has(candidate)
       && labels.some(label => textFor(candidate).includes(label)));
     if (control) { setValue(control, value); used.add(control); filled.push(labels[0]); }
   }
-  const provider = Array.from(document.querySelectorAll('button, label, [role="radio"]'))
-    .find(element => normalized(element.textContent).includes('github'));
-  if (provider && filled.length === 0) provider.click();
   let submitted = false;
-  if (shouldSubmit && filled.length >= 3) {
-    const button = Array.from(document.querySelectorAll('button, input[type="submit"]'))
+  const required = ['organization', 'repository', 'workflow', ...(githubForm?.id.startsWith('pending-') ? ['project'] : [])];
+  const form = githubForm || controls.find(control => /repository|repo/.test(textFor(control)))?.closest('form');
+  if (shouldSubmit && required.every(field => filled.includes(field))) {
+    const button = Array.from((form || document).querySelectorAll('button, input[type="submit"]'))
       .find(candidate => /add|save|configure|submit/.test(normalized(candidate.textContent || candidate.value))
-        && !candidate.disabled);
+        && !candidate.disabled && !candidate.classList.contains('button--disabled'));
     if (button) { button.click(); submitted = true; }
   }
   return { filled, providerSelected: Boolean(provider), submitted };

package/src/ci-credential-cycle.mjs

@@ -48,13 +48,18 @@ export function completeRotation(state, repos, secret, id) {
 }
 
 /** CI drives rotation. Uncertain tests preserve every existing credential. */
-export async function cycleCredential(adapter) {
+export async function cycleCredential(adapter, { force = false } = {}) {
   const health = await adapter.health();
-  if (health.status === "ok") {
+  if (!force && health.status === "ok") {
     return { status: "ok", changed: false };
   }
   const previous = await adapter.metadata();
-  if (health.status === "unknown" && previous && previous.present !== false) {
+  if (
+    !force &&
+    health.status === "unknown" &&
+    previous &&
+    previous.present !== false
+  ) {
     const tested = await adapter.test();
     if (tested.status === "ok") {
       return { status: "ok", changed: false };

package/src/cli-main.mjs

@@ -35,6 +35,9 @@ Global options:
   --repository <path>             Inspect only this repository (default: widest scope)
   --org <org> | --user <login>      Scan repositories through gh-manager
   --secret-name <template>         Secret name; supports {REGISTRY}, {REPO}, {ORG}
+  --rotate-token <secret>          Explicitly replace a legacy crates.io token
+  --migrate                       Convert token jobs in PRs, then verify OIDC and clean up secrets
+  --token-expiry-days <N>          Read browser token inventory in account scans
   --format <text|json>            Output format (default: text)
   --offline                       Do not look up packages on registries
   --verbose                       Print command details and output, and
@@ -67,11 +70,11 @@ Setup options:
                                   through the crates.io API
   --keep-session                  Stay signed in after setup: npm keeps its
                                   session token in npm's user configuration
-                                  until npm logout; crates.io keeps only the
-                                  automated profile's browser session
+                                  until npm logout; the shared browser profile
+                                  keeps registry sessions across packages
   --browser <default|automated>   Open sign-in and approval pages in your
-                                  default browser, or in the automated
-                                  profile too (default: default)
+                                  default browser, or in the automated profile;
+                                  npm reuses the automated profile
   --browser-channel <channel>     Installed browser channel (default: chrome):
                                   ${launchChannels().join(", ")}
   --browser-executable <path>     Installed browser executable to launch
@@ -83,7 +86,7 @@ Setup options:
                                   ${importSources().join(", ")}
                                   into the automated profile; default takes the
                                   system default browser, auto the first
-                                  browser signed in to the registry
+                                  browser with registry cookies or saved logins
   --browser-import-scope <full|domains>
                                   Import the whole profile, or only the
                                   registry's sign-in cookies (default: full
@@ -111,6 +114,9 @@ export async function main(args = process.argv.slice(2)) {
       org: { type: "string" },
       user: { type: "string" },
       "secret-name": { type: "string" },
+      "rotate-token": { type: "string" },
+      migrate: { type: "boolean", default: false },
+      "token-expiry-days": { type: "string" },
       format: { type: "string", default: "text" },
       verbose: { type: "boolean", default: false },
       offline: { type: "boolean", default: false },
@@ -174,6 +180,47 @@ export async function main(args = process.argv.slice(2)) {
   }
   const repository = path.resolve(values.repository ?? ".");
   const command = positionals[0];
+  const rotateToken = values["rotate-token"];
+  if (
+    values.migrate &&
+    (command !== "setup" ||
+      rotateToken !== undefined ||
+      !values.registry?.length ||
+      (values.registry ?? []).some(
+        (registry) => !["crates-io", "npm", "pypi"].includes(registry),
+      ))
+  ) {
+    throw new Error(
+      "--migrate requires setup with crates-io, npm or pypi and cannot use --rotate-token",
+    );
+  }
+  if (
+    rotateToken !== undefined &&
+    (command !== "setup" ||
+      (values.registry ?? []).map(parseRegistry).join() !== "crates-io" ||
+      !/^[A-Z_][A-Z0-9_]{0,244}$/.test(rotateToken) ||
+      rotateToken.startsWith("GITHUB_"))
+  ) {
+    throw new Error(
+      "--rotate-token requires setup --registry crates-io and a valid secret name",
+    );
+  }
+  const tokenExpiryDays =
+    values["token-expiry-days"] === undefined
+      ? undefined
+      : Number(values["token-expiry-days"]);
+  if (
+    tokenExpiryDays !== undefined &&
+    (!/^\d+$/.test(values["token-expiry-days"]) ||
+      !Number.isInteger(tokenExpiryDays) ||
+      tokenExpiryDays < 0 ||
+      tokenExpiryDays > 365 ||
+      !(values.org || values.user))
+  ) {
+    throw new Error(
+      "--token-expiry-days requires an account scan and an integer between 0 and 365",
+    );
+  }
   if (values.org || values.user) {
     if (values.org && values.user) {
       throw new Error("--org and --user are mutually exclusive");
@@ -184,7 +231,10 @@ export async function main(args = process.argv.slice(2)) {
     if (!["inspect", "plan", "setup"].includes(command)) {
       throw new Error(`unknown command '${command}'`);
     }
-    if (command === "setup" && (!values.all || values.package)) {
+    if (
+      command === "setup" &&
+      ((!values.all && !rotateToken && !values.migrate) || values.package)
+    ) {
       throw new Error("account setup requires --all without --package");
     }
     if (values["dry-run"] && values.execute) {
@@ -215,6 +265,9 @@ export async function main(args = process.argv.slice(2)) {
         yes: values.yes,
         noBrowser: values["no-browser"],
         secretName: values["secret-name"],
+        rotateToken,
+        migrate: values.migrate,
+        tokenExpiryDays,
         package: values.package,
         browser: values.browser,
         browserOptions,
@@ -228,6 +281,7 @@ export async function main(args = process.argv.slice(2)) {
           workflow: values.workflow,
           publisherEnvironment: values.environment,
           addPublishJob: values["add-publish-job"],
+          migrate: values.migrate,
           manual: values.manual,
           verifyRelease: values["verify-release"],
         },
@@ -269,6 +323,8 @@ export async function main(args = process.argv.slice(2)) {
     ),
   });
   const planOptions = {
+    rotateToken,
+    migrate: values.migrate,
     ref: values.ref,
     verifyRelease: values["verify-release"],
     manual: values.manual,
@@ -327,8 +383,12 @@ export async function main(args = process.argv.slice(2)) {
       openWith: nonEmpty(values["open-with"], "--open-with"),
       keepSession: values["keep-session"],
       secretName: values["secret-name"],
+      rotateToken,
+      migrate: values.migrate,
       quietBrowser: selected.some((plan) =>
-        plan.steps.some((step) => step.id === "manage-registry-token"),
+        plan.steps.some((step) =>
+          ["manage-registry-token", "rotate-crates-token"].includes(step.id),
+        ),
       ),
       browser: values.browser,
       browserOptions,

package/src/crates-api.mjs

@@ -104,15 +104,16 @@ export async function readSession(page) {
  * unverified one stops here with the settings link.
  */
 export async function signIn(page, options = {}) {
+  const log = options.log ?? console.log;
   await page.goto(CRATES_IO_URL);
   let session = await readSession(page);
   const signedInBefore = session.signedIn;
   if (!session.signedIn) {
-    console.log(
+    log(
       "  Not signed in to crates.io; finish the GitHub sign-in in the automated browser.",
     );
     if (!(await page.evaluate(LOGIN_CLICK_SCRIPT))) {
-      console.log('  Click "Log in with GitHub" on crates.io.');
+      log('  Click "Log in with GitHub" on crates.io.');
     }
     const deadline = Date.now() + (options.timeoutMs ?? SIGN_IN_TIMEOUT_MS);
     const interval = options.pollIntervalMs ?? 2_000;
@@ -124,9 +125,7 @@ export async function signIn(page, options = {}) {
       session = await readSession(page);
     }
   }
-  console.log(
-    `  Signed in to crates.io as ${session.login ?? "your account"}.`,
-  );
+  log(`  Signed in to crates.io as ${session.login ?? "your account"}.`);
   if (!session.emailVerified) {
     const sent = session.emailSent
       ? " A verification email was sent; follow its link,"

package/src/crates-token-rotation.mjs

@@ -0,0 +1,265 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { githubServices } from "./github.mjs";
+import {
+  cycleCredential,
+  secretName,
+  trackedTokenIds,
+  recordTokenId,
+  completeRotation,
+} from "./ci-credential-cycle.mjs";
+import { pageFetchScript, runCratesApiStep } from "./crates-api.mjs";
+import {
+  listCratesTokens,
+  selectCratesToken,
+  replacementTokenRequest,
+} from "./crates-tokens.mjs";
+import { AUTH_FAILURE_PATTERNS } from "./publishing-policy.mjs";
+
+/** Explicit maintenance of existing legacy secrets; ordinary crates setup uses OIDC. */
+export async function rotateCratesToken(session) {
+  const { options, plan } = session;
+  const secret = secretName(
+    options.rotateToken,
+    "crates-io",
+    `${plan.repository.github_owner}/${plan.repository.github_repository}`,
+  );
+  if (
+    options.noBrowser ||
+    options.browserOptions?.attach ||
+    options.browserOptions?.importScope === "full"
+  ) {
+    throw new Error(
+      "token rotation requires a dedicated profile with domain-scoped sign-in import",
+    );
+  }
+  const settings =
+    JSON.parse(
+      await readFile(
+        path.join(options.repository, ".package-registry-manager.json"),
+        "utf8",
+      ).catch((error) => {
+        if (error.code === "ENOENT") {
+          return "{}";
+        }
+        throw error;
+      }),
+    ).tokens?.["crates-io"] ?? {};
+  if (settings.level && !["repo", "org"].includes(settings.level)) {
+    throw new Error("token secret level must be repo or org");
+  }
+  const github = options.github ?? githubServices(options);
+  const owner = plan.repository.github_owner;
+  const slug = `${owner}/${plan.repository.github_repository}`;
+  if (!owner || !plan.repository.github_repository) {
+    throw new Error("token rotation requires GitHub repository coordinates");
+  }
+  const key = `${settings.level === "repo" ? slug : owner}:${secret}`;
+  if (options.rotatedSecrets?.has(key)) {
+    const outcome = options.rotatedSecrets.get(key);
+    if (!outcome) {
+      throw new Error(
+        "previous rotation could not be verified; credentials retained",
+      );
+    }
+    session.outcome = outcome;
+    return;
+  }
+  options.rotatedSecrets?.set(key, null);
+  const targets =
+    settings.level === "repo"
+      ? [slug]
+      : (options.secretRepositories?.[`crates-io:${secret}`] ?? [slug]);
+  const scope = settings.level === "repo" ? { repo: slug } : { org: owner };
+  let metadata;
+  try {
+    metadata = await github.secrets(scope).getMetadata(secret);
+  } catch (error) {
+    if (![403, 404, 422].includes(error.status)) {
+      throw error;
+    }
+  }
+  metadata ??= await github.secrets({ repo: slug }).getMetadata(secret);
+  if (!metadata) {
+    throw new Error(`existing secret ${secret} was not found`);
+  }
+  // Keep access unchanged and test consumers beyond the current plan selection too.
+  const granted =
+    metadata.selected_repositories?.map((repo) => repo.full_name) ?? [];
+  const consumers = [...new Set([...targets, ...granted])];
+  if (
+    scope.org &&
+    ["all", "private"].includes(metadata.visibility) &&
+    !options.accountScan
+  ) {
+    throw new Error(
+      "rotation of an all/private organization secret requires --org to discover every consumer",
+    );
+  }
+  if (options.accountScan && options.scanErrors) {
+    throw new Error("token rotation requires a complete account scan");
+  }
+  if (
+    !options.yes &&
+    !/^y(?:es)?$/i.test(
+      await session.prompt(
+        "Replace the legacy token, verify consumers in CI, then revoke the old token? [y/N] ",
+      ),
+    )
+  ) {
+    throw new Error("credential creation declined");
+  }
+  await runCratesApiStep(session, { id: "crates-sign-in" });
+  const page = await session.automatedPage(options.browserOptions, true);
+  const previous = selectCratesToken(
+    await listCratesTokens(page),
+    secret,
+    metadata,
+    settings.token_id,
+  );
+  const request = replacementTokenRequest(previous, settings.expiry_days ?? 30);
+  const stateFile =
+    options.browserProfile &&
+    path.join(path.dirname(options.browserProfile), "credential-ids.json");
+  const state = stateFile
+    ? JSON.parse(
+        await readFile(stateFile, "utf8").catch((error) => {
+          if (error.code === "ENOENT") {
+            return "{}";
+          }
+          throw error;
+        }),
+      )
+    : {};
+  const persist = async () => {
+    if (stateFile) {
+      await mkdir(path.dirname(stateFile), { recursive: true });
+      await writeFile(stateFile, JSON.stringify(state));
+    }
+  };
+  const previousId = String(previous.id);
+  const retained = Object.entries(state).some(
+    ([entry, ids]) =>
+      !consumers.some((repo) => entry === `${repo}:${secret}`) &&
+      ids.includes(previousId),
+  );
+  if (options.verbose) {
+    console.error(
+      `Rotate crates.io token ${previousId}; verify ${consumers.join(", ")}`,
+    );
+  }
+  const result = await cycleCredential(
+    {
+      health: async () => ({ status: "ok" }),
+      metadata: async () => ({
+        token_id: retained ? undefined : previousId,
+        token_ids: trackedTokenIds(state, consumers, secret),
+      }),
+      create: async () => {
+        const created = await page.evaluate(
+          pageFetchScript("PUT", "/api/v1/me/tokens", request),
+        );
+        const token = created.body?.api_token;
+        if (
+          created.status !== 200 ||
+          !token?.token ||
+          token.id === undefined ||
+          token.id === null
+        ) {
+          throw new Error(
+            `crates.io token creation failed (${created.status})`,
+          );
+        }
+        return {
+          id: String(token.id),
+          value: token.token,
+          expires_at: token.expired_at ?? request.api_token.expired_at,
+        };
+      },
+      ensure: async (credential) => {
+        const broad =
+          scope.org && ["all", "private"].includes(metadata.visibility);
+        const stored = broad
+          ? {
+              ...(await github.secrets(scope).set(secret, credential.value, {
+                visibility: metadata.visibility,
+                expiresAt: credential.expires_at,
+              })),
+              path: "organization",
+            }
+          : await github.secrets(scope).ensure(secret, {
+              ...(scope.org
+                ? { repos: consumers, visibility: "selected" }
+                : {}),
+              health: { status: "auth-failing" },
+              rotateBeforeMs: 0,
+              acquire: async () => ({
+                value: credential.value,
+                expiresAt: credential.expires_at,
+              }),
+            });
+        for (const repo of consumers) {
+          if (
+            stored.path === "organization" &&
+            (await github.secrets({ repo }).getMetadata(secret))
+          ) {
+            await github.secrets({ repo }).set(secret, credential.value, {
+              expiresAt: credential.expires_at,
+            });
+          }
+        }
+        if (stored.valueChanged === false) {
+          throw new Error(
+            "gh-manager did not store the replacement credential",
+          );
+        }
+        recordTokenId(state, consumers, secret, credential.id);
+        await persist();
+        return stored;
+      },
+      test: async () => {
+        for (const repo of consumers) {
+          const result = await github.health.test(secret, {
+            scope: { repo },
+            failurePatterns: AUTH_FAILURE_PATTERNS["crates-io"],
+          });
+          if (result.status !== "ok") {
+            return { status: "unknown" };
+          }
+        }
+        return { status: "ok" };
+      },
+      revoke: async (id) => {
+        const revoked = await page.evaluate(
+          pageFetchScript(
+            "DELETE",
+            `/api/v1/me/tokens/${encodeURIComponent(id)}`,
+          ),
+        );
+        if (![200, 204].includes(revoked.status)) {
+          throw new Error(
+            `crates.io token revocation failed (${revoked.status})`,
+          );
+        }
+      },
+      revoked: async (id) =>
+        !(await listCratesTokens(page)).some(
+          (token) => String(token.id) === id,
+        ),
+    },
+    { force: true },
+  );
+  completeRotation(state, consumers, secret, result.token_id);
+  await persist();
+  session.outcome = {
+    status: "configured",
+    secret,
+    secret_scope: result.path,
+    fallback_reason: result.fallbackReason,
+    token_id: result.token_id,
+  };
+  options.rotatedSecrets?.set(key, session.outcome);
+  console.log(
+    `Migrate these repositories to crates.io trusted publishing before deleting the legacy token secret: ${consumers.join(", ")}`,
+  );
+}