package-registry-manager 0.22.11 → 0.23.0

package/README.md

@@ -35,6 +35,21 @@ one browser, groups npm approvals, and uses CI evidence to preserve healthy toke
 or verify replacements before revocation. `--secret-name '{REGISTRY}_TOKEN_{REPO}'`
 selects custom credential names.
 
+For legacy crates.io consumers, use `setup --org ORG --registry crates-io
+--rotate-token CARGO_TOKEN --execute --browser-import auto`. Rotation preserves
+scopes and GitHub visibility, stores an expiry companion secret, verifies every
+consumer in CI before revocation, and lists migration targets. Ordinary crates.io
+setup uses trusted publishing. `inspect --org ORG --token-expiry-days 7` opens the
+private browser token inventory for advance expiry warnings. See the
+[rotation configuration](../README.md#configuration) for matching and failure behavior.
+
+`setup --org ORG --registry crates-io --migrate --execute --browser-import auto`
+proposes a reviewed conversion of existing jobs and reusable callers. After merging,
+rerun it to register trust, and rerun after a real OIDC release to remove verified
+legacy secrets. Shared organization secrets remain while other consumers exist.
+The same flow supports `--registry npm` and `--registry pypi`; see the
+[migration workflow](../README.md#configuration) for supported layouts and safeguards.
+
 Account scans print progress to stderr (`[37/169] owner/repository`) and stream
 text inspection results as each repository finishes. JSON inspection remains one
 report on stdout. Repository, manifest, registry lookup, and release-log failures are

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "package-registry-manager",
-  "version": "0.22.11",
+  "version": "0.23.0",
   "description": "Inspect repositories and guide secure package-registry setup",
   "type": "module",
   "bin": {

package/src/ci-credential-cycle.mjs

@@ -48,13 +48,18 @@ export function completeRotation(state, repos, secret, id) {
 }
 
 /** CI drives rotation. Uncertain tests preserve every existing credential. */
-export async function cycleCredential(adapter) {
+export async function cycleCredential(adapter, { force = false } = {}) {
   const health = await adapter.health();
-  if (health.status === "ok") {
+  if (!force && health.status === "ok") {
     return { status: "ok", changed: false };
   }
   const previous = await adapter.metadata();
-  if (health.status === "unknown" && previous && previous.present !== false) {
+  if (
+    !force &&
+    health.status === "unknown" &&
+    previous &&
+    previous.present !== false
+  ) {
     const tested = await adapter.test();
     if (tested.status === "ok") {
       return { status: "ok", changed: false };

package/src/cli-main.mjs

@@ -35,6 +35,9 @@ Global options:
   --repository <path>             Inspect only this repository (default: widest scope)
   --org <org> | --user <login>      Scan repositories through gh-manager
   --secret-name <template>         Secret name; supports {REGISTRY}, {REPO}, {ORG}
+  --rotate-token <secret>          Explicitly replace a legacy crates.io token
+  --migrate                       Convert token jobs in PRs, then verify OIDC and clean up secrets
+  --token-expiry-days <N>          Read browser token inventory in account scans
   --format <text|json>            Output format (default: text)
   --offline                       Do not look up packages on registries
   --verbose                       Print command details and output, and
@@ -111,6 +114,9 @@ export async function main(args = process.argv.slice(2)) {
       org: { type: "string" },
       user: { type: "string" },
       "secret-name": { type: "string" },
+      "rotate-token": { type: "string" },
+      migrate: { type: "boolean", default: false },
+      "token-expiry-days": { type: "string" },
       format: { type: "string", default: "text" },
       verbose: { type: "boolean", default: false },
       offline: { type: "boolean", default: false },
@@ -174,6 +180,47 @@ export async function main(args = process.argv.slice(2)) {
   }
   const repository = path.resolve(values.repository ?? ".");
   const command = positionals[0];
+  const rotateToken = values["rotate-token"];
+  if (
+    values.migrate &&
+    (command !== "setup" ||
+      rotateToken !== undefined ||
+      !values.registry?.length ||
+      (values.registry ?? []).some(
+        (registry) => !["crates-io", "npm", "pypi"].includes(registry),
+      ))
+  ) {
+    throw new Error(
+      "--migrate requires setup with crates-io, npm or pypi and cannot use --rotate-token",
+    );
+  }
+  if (
+    rotateToken !== undefined &&
+    (command !== "setup" ||
+      (values.registry ?? []).map(parseRegistry).join() !== "crates-io" ||
+      !/^[A-Z_][A-Z0-9_]{0,244}$/.test(rotateToken) ||
+      rotateToken.startsWith("GITHUB_"))
+  ) {
+    throw new Error(
+      "--rotate-token requires setup --registry crates-io and a valid secret name",
+    );
+  }
+  const tokenExpiryDays =
+    values["token-expiry-days"] === undefined
+      ? undefined
+      : Number(values["token-expiry-days"]);
+  if (
+    tokenExpiryDays !== undefined &&
+    (!/^\d+$/.test(values["token-expiry-days"]) ||
+      !Number.isInteger(tokenExpiryDays) ||
+      tokenExpiryDays < 0 ||
+      tokenExpiryDays > 365 ||
+      !(values.org || values.user))
+  ) {
+    throw new Error(
+      "--token-expiry-days requires an account scan and an integer between 0 and 365",
+    );
+  }
   if (values.org || values.user) {
     if (values.org && values.user) {
       throw new Error("--org and --user are mutually exclusive");
@@ -184,7 +231,10 @@ export async function main(args = process.argv.slice(2)) {
     if (!["inspect", "plan", "setup"].includes(command)) {
       throw new Error(`unknown command '${command}'`);
     }
-    if (command === "setup" && (!values.all || values.package)) {
+    if (
+      command === "setup" &&
+      ((!values.all && !rotateToken && !values.migrate) || values.package)
+    ) {
       throw new Error("account setup requires --all without --package");
     }
     if (values["dry-run"] && values.execute) {
@@ -215,6 +265,9 @@ export async function main(args = process.argv.slice(2)) {
         yes: values.yes,
         noBrowser: values["no-browser"],
         secretName: values["secret-name"],
+        rotateToken,
+        migrate: values.migrate,
+        tokenExpiryDays,
         package: values.package,
         browser: values.browser,
         browserOptions,
@@ -228,6 +281,7 @@ export async function main(args = process.argv.slice(2)) {
           workflow: values.workflow,
           publisherEnvironment: values.environment,
           addPublishJob: values["add-publish-job"],
+          migrate: values.migrate,
           manual: values.manual,
           verifyRelease: values["verify-release"],
         },
@@ -269,6 +323,8 @@ export async function main(args = process.argv.slice(2)) {
     ),
   });
   const planOptions = {
+    rotateToken,
+    migrate: values.migrate,
     ref: values.ref,
     verifyRelease: values["verify-release"],
     manual: values.manual,
@@ -327,8 +383,12 @@ export async function main(args = process.argv.slice(2)) {
       openWith: nonEmpty(values["open-with"], "--open-with"),
       keepSession: values["keep-session"],
       secretName: values["secret-name"],
+      rotateToken,
+      migrate: values.migrate,
       quietBrowser: selected.some((plan) =>
-        plan.steps.some((step) => step.id === "manage-registry-token"),
+        plan.steps.some((step) =>
+          ["manage-registry-token", "rotate-crates-token"].includes(step.id),
+        ),
       ),
       browser: values.browser,
       browserOptions,

package/src/crates-api.mjs

@@ -104,15 +104,16 @@ export async function readSession(page) {
  * unverified one stops here with the settings link.
  */
 export async function signIn(page, options = {}) {
+  const log = options.log ?? console.log;
   await page.goto(CRATES_IO_URL);
   let session = await readSession(page);
   const signedInBefore = session.signedIn;
   if (!session.signedIn) {
-    console.log(
+    log(
       "  Not signed in to crates.io; finish the GitHub sign-in in the automated browser.",
     );
     if (!(await page.evaluate(LOGIN_CLICK_SCRIPT))) {
-      console.log('  Click "Log in with GitHub" on crates.io.');
+      log('  Click "Log in with GitHub" on crates.io.');
     }
     const deadline = Date.now() + (options.timeoutMs ?? SIGN_IN_TIMEOUT_MS);
     const interval = options.pollIntervalMs ?? 2_000;
@@ -124,9 +125,7 @@ export async function signIn(page, options = {}) {
       session = await readSession(page);
     }
   }
-  console.log(
-    `  Signed in to crates.io as ${session.login ?? "your account"}.`,
-  );
+  log(`  Signed in to crates.io as ${session.login ?? "your account"}.`);
   if (!session.emailVerified) {
     const sent = session.emailSent
       ? " A verification email was sent; follow its link,"

package/src/crates-token-rotation.mjs

@@ -0,0 +1,265 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { githubServices } from "./github.mjs";
+import {
+  cycleCredential,
+  secretName,
+  trackedTokenIds,
+  recordTokenId,
+  completeRotation,
+} from "./ci-credential-cycle.mjs";
+import { pageFetchScript, runCratesApiStep } from "./crates-api.mjs";
+import {
+  listCratesTokens,
+  selectCratesToken,
+  replacementTokenRequest,
+} from "./crates-tokens.mjs";
+import { AUTH_FAILURE_PATTERNS } from "./publishing-policy.mjs";
+
+/** Explicit maintenance of existing legacy secrets; ordinary crates setup uses OIDC. */
+export async function rotateCratesToken(session) {
+  const { options, plan } = session;
+  const secret = secretName(
+    options.rotateToken,
+    "crates-io",
+    `${plan.repository.github_owner}/${plan.repository.github_repository}`,
+  );
+  if (
+    options.noBrowser ||
+    options.browserOptions?.attach ||
+    options.browserOptions?.importScope === "full"
+  ) {
+    throw new Error(
+      "token rotation requires a dedicated profile with domain-scoped sign-in import",
+    );
+  }
+  const settings =
+    JSON.parse(
+      await readFile(
+        path.join(options.repository, ".package-registry-manager.json"),
+        "utf8",
+      ).catch((error) => {
+        if (error.code === "ENOENT") {
+          return "{}";
+        }
+        throw error;
+      }),
+    ).tokens?.["crates-io"] ?? {};
+  if (settings.level && !["repo", "org"].includes(settings.level)) {
+    throw new Error("token secret level must be repo or org");
+  }
+  const github = options.github ?? githubServices(options);
+  const owner = plan.repository.github_owner;
+  const slug = `${owner}/${plan.repository.github_repository}`;
+  if (!owner || !plan.repository.github_repository) {
+    throw new Error("token rotation requires GitHub repository coordinates");
+  }
+  const key = `${settings.level === "repo" ? slug : owner}:${secret}`;
+  if (options.rotatedSecrets?.has(key)) {
+    const outcome = options.rotatedSecrets.get(key);
+    if (!outcome) {
+      throw new Error(
+        "previous rotation could not be verified; credentials retained",
+      );
+    }
+    session.outcome = outcome;
+    return;
+  }
+  options.rotatedSecrets?.set(key, null);
+  const targets =
+    settings.level === "repo"
+      ? [slug]
+      : (options.secretRepositories?.[`crates-io:${secret}`] ?? [slug]);
+  const scope = settings.level === "repo" ? { repo: slug } : { org: owner };
+  let metadata;
+  try {
+    metadata = await github.secrets(scope).getMetadata(secret);
+  } catch (error) {
+    if (![403, 404, 422].includes(error.status)) {
+      throw error;
+    }
+  }
+  metadata ??= await github.secrets({ repo: slug }).getMetadata(secret);
+  if (!metadata) {
+    throw new Error(`existing secret ${secret} was not found`);
+  }
+  // Keep access unchanged and test consumers beyond the current plan selection too.
+  const granted =
+    metadata.selected_repositories?.map((repo) => repo.full_name) ?? [];
+  const consumers = [...new Set([...targets, ...granted])];
+  if (
+    scope.org &&
+    ["all", "private"].includes(metadata.visibility) &&
+    !options.accountScan
+  ) {
+    throw new Error(
+      "rotation of an all/private organization secret requires --org to discover every consumer",
+    );
+  }
+  if (options.accountScan && options.scanErrors) {
+    throw new Error("token rotation requires a complete account scan");
+  }
+  if (
+    !options.yes &&
+    !/^y(?:es)?$/i.test(
+      await session.prompt(
+        "Replace the legacy token, verify consumers in CI, then revoke the old token? [y/N] ",
+      ),
+    )
+  ) {
+    throw new Error("credential creation declined");
+  }
+  await runCratesApiStep(session, { id: "crates-sign-in" });
+  const page = await session.automatedPage(options.browserOptions, true);
+  const previous = selectCratesToken(
+    await listCratesTokens(page),
+    secret,
+    metadata,
+    settings.token_id,
+  );
+  const request = replacementTokenRequest(previous, settings.expiry_days ?? 30);
+  const stateFile =
+    options.browserProfile &&
+    path.join(path.dirname(options.browserProfile), "credential-ids.json");
+  const state = stateFile
+    ? JSON.parse(
+        await readFile(stateFile, "utf8").catch((error) => {
+          if (error.code === "ENOENT") {
+            return "{}";
+          }
+          throw error;
+        }),
+      )
+    : {};
+  const persist = async () => {
+    if (stateFile) {
+      await mkdir(path.dirname(stateFile), { recursive: true });
+      await writeFile(stateFile, JSON.stringify(state));
+    }
+  };
+  const previousId = String(previous.id);
+  const retained = Object.entries(state).some(
+    ([entry, ids]) =>
+      !consumers.some((repo) => entry === `${repo}:${secret}`) &&
+      ids.includes(previousId),
+  );
+  if (options.verbose) {
+    console.error(
+      `Rotate crates.io token ${previousId}; verify ${consumers.join(", ")}`,
+    );
+  }
+  const result = await cycleCredential(
+    {
+      health: async () => ({ status: "ok" }),
+      metadata: async () => ({
+        token_id: retained ? undefined : previousId,
+        token_ids: trackedTokenIds(state, consumers, secret),
+      }),
+      create: async () => {
+        const created = await page.evaluate(
+          pageFetchScript("PUT", "/api/v1/me/tokens", request),
+        );
+        const token = created.body?.api_token;
+        if (
+          created.status !== 200 ||
+          !token?.token ||
+          token.id === undefined ||
+          token.id === null
+        ) {
+          throw new Error(
+            `crates.io token creation failed (${created.status})`,
+          );
+        }
+        return {
+          id: String(token.id),
+          value: token.token,
+          expires_at: token.expired_at ?? request.api_token.expired_at,
+        };
+      },
+      ensure: async (credential) => {
+        const broad =
+          scope.org && ["all", "private"].includes(metadata.visibility);
+        const stored = broad
+          ? {
+              ...(await github.secrets(scope).set(secret, credential.value, {
+                visibility: metadata.visibility,
+                expiresAt: credential.expires_at,
+              })),
+              path: "organization",
+            }
+          : await github.secrets(scope).ensure(secret, {
+              ...(scope.org
+                ? { repos: consumers, visibility: "selected" }
+                : {}),
+              health: { status: "auth-failing" },
+              rotateBeforeMs: 0,
+              acquire: async () => ({
+                value: credential.value,
+                expiresAt: credential.expires_at,
+              }),
+            });
+        for (const repo of consumers) {
+          if (
+            stored.path === "organization" &&
+            (await github.secrets({ repo }).getMetadata(secret))
+          ) {
+            await github.secrets({ repo }).set(secret, credential.value, {
+              expiresAt: credential.expires_at,
+            });
+          }
+        }
+        if (stored.valueChanged === false) {
+          throw new Error(
+            "gh-manager did not store the replacement credential",
+          );
+        }
+        recordTokenId(state, consumers, secret, credential.id);
+        await persist();
+        return stored;
+      },
+      test: async () => {
+        for (const repo of consumers) {
+          const result = await github.health.test(secret, {
+            scope: { repo },
+            failurePatterns: AUTH_FAILURE_PATTERNS["crates-io"],
+          });
+          if (result.status !== "ok") {
+            return { status: "unknown" };
+          }
+        }
+        return { status: "ok" };
+      },
+      revoke: async (id) => {
+        const revoked = await page.evaluate(
+          pageFetchScript(
+            "DELETE",
+            `/api/v1/me/tokens/${encodeURIComponent(id)}`,
+          ),
+        );
+        if (![200, 204].includes(revoked.status)) {
+          throw new Error(
+            `crates.io token revocation failed (${revoked.status})`,
+          );
+        }
+      },
+      revoked: async (id) =>
+        !(await listCratesTokens(page)).some(
+          (token) => String(token.id) === id,
+        ),
+    },
+    { force: true },
+  );
+  completeRotation(state, consumers, secret, result.token_id);
+  await persist();
+  session.outcome = {
+    status: "configured",
+    secret,
+    secret_scope: result.path,
+    fallback_reason: result.fallbackReason,
+    token_id: result.token_id,
+  };
+  options.rotatedSecrets?.set(key, session.outcome);
+  console.log(
+    `Migrate these repositories to crates.io trusted publishing before deleting the legacy token secret: ${consumers.join(", ")}`,
+  );
+}

package/src/crates-tokens.mjs

@@ -0,0 +1,110 @@
+import { pageFetchScript } from "./crates-api.mjs";
+
+/** Fetch private token metadata through the authenticated browser, without values. */
+export async function listCratesTokens(page) {
+  const result = await page.evaluate(
+    pageFetchScript("GET", "/api/v1/me/tokens?expired_days=365"),
+  );
+  if (result.status !== 200 || !Array.isArray(result.body?.api_tokens)) {
+    throw new Error(`crates.io token inventory unavailable (${result.status})`);
+  }
+  return result.body.api_tokens.map(
+    ({ id, name, created_at, expired_at, crate_scopes, endpoint_scopes }) => ({
+      id,
+      name,
+      created_at,
+      expired_at,
+      crate_scopes,
+      endpoint_scopes,
+    }),
+  );
+}
+
+/** GitHub cannot reveal a secret value: refuse absent or ambiguous metadata matches. */
+export function selectCratesToken(tokens, secret, metadata, id) {
+  const updated = Date.parse(metadata?.updated_at ?? "");
+  let matches;
+  if (id !== undefined && id !== null) {
+    matches = tokens.filter((token) => String(token.id) === String(id));
+  } else {
+    const named = tokens.filter(
+      (token) => token.name?.toUpperCase() === secret.toUpperCase(),
+    );
+    matches = named.length ? named : tokens;
+    if (Number.isFinite(updated)) {
+      matches = matches.filter(
+        (token) => Math.abs(Date.parse(token.created_at) - updated) <= 300_000,
+      );
+    } else if (!named.length) {
+      matches = [];
+    }
+  }
+  if (
+    matches.length !== 1 ||
+    matches[0].id === undefined ||
+    matches[0].id === null
+  ) {
+    throw new Error(
+      `cannot uniquely identify crates.io token for ${secret}; configure tokens.crates-io.token_id`,
+    );
+  }
+  return matches[0];
+}
+
+/** Preserve even legacy null scopes; only the name and expiry change. */
+export function replacementTokenRequest(previous, days = 30, now = Date.now()) {
+  if (!Number.isInteger(days) || days < 1 || days > 90) {
+    throw new Error("token expiry_days must be between 1 and 90");
+  }
+  for (const key of ["crate_scopes", "endpoint_scopes"]) {
+    if (
+      previous[key] !== null &&
+      (!Array.isArray(previous[key]) ||
+        previous[key].some((scope) => typeof scope !== "string"))
+    ) {
+      throw new Error(
+        `crates.io token has no usable ${key}; refusing to broaden scopes`,
+      );
+    }
+  }
+  return {
+    api_token: {
+      name: previous.name,
+      crate_scopes: previous.crate_scopes,
+      endpoint_scopes: previous.endpoint_scopes,
+      expired_at: new Date(now + days * 86_400_000).toISOString(),
+    },
+  };
+}
+
+/** Include expired tokens and the inclusive lead-time boundary. */
+export function tokenExpiryFindings(
+  tokens,
+  account,
+  days = 7,
+  now = Date.now(),
+) {
+  if (!Number.isInteger(days) || days < 0 || days > 365) {
+    throw new Error("--token-expiry-days must be an integer between 0 and 365");
+  }
+  return tokens.flatMap((token) => {
+    const expiry = Date.parse(token.expired_at ?? "");
+    return Number.isFinite(expiry) && expiry <= now + days * 86_400_000
+      ? [
+          {
+            repository: account,
+            registry: "crates-io",
+            type:
+              expiry <= now
+                ? "registry-token-expired"
+                : "registry-token-expiring",
+            evidence: {
+              token_id: token.id,
+              name: token.name,
+              expires_at: token.expired_at,
+            },
+          },
+        ]
+      : [];
+  });
+}

package/src/github.mjs

@@ -25,6 +25,7 @@ export function githubServices(options = {}) {
   };
   const context = { rest, log };
   return {
+    rest,
     repos: createRepoManager(context),
     runs: createRunManager(context),
     health: createSecretHealth(context),