permdock 0.4.0 → 0.5.0

package/dist/terminal/index.js

@@ -1,161 +1,16 @@
-import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-drnfxYtm.js";
+import { t as compact } from "../compact-CAf557ZB.js";
+import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-BKy0EfhN.js";
+import { h as secondsAt } from "../time-DkWjdL98.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { i as isSubject } from "../subject-C6dLxqHU.js";
-import { l as storedApprovalToken, s as resumeDecision } from "../helpers-C9YmyBIa.js";
+import { c as withApp } from "../permdock-B9JxkBwC.js";
+import { r as isSubject } from "../subject-BGoM5o8B.js";
+import { n as readBodyText } from "../body-text-QcXok_SI.js";
+import { l as storedApprovalToken, s as resumeDecision } from "../helpers-DTcZOzhF.js";
 import { t as timeoutSignal } from "../timeout-D51niuQP.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-DIIV9DbC.js";
-import { mkdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
-import path from "node:path";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-BMnAudHn.js";
+import { a as refreshCredential, o as revokeCredential, s as runDeviceFlow, t as TERMINAL_TIMEOUT_MS } from "../device-BARQ8eYG.js";
+import { i as writeCredentials, n as deleteCredentials, r as readCredentials } from "../storage-C2bWdvJH.js";
 import { createInterface } from "node:readline";
-import { homedir } from "node:os";
-//#region src/terminal/device.ts
-/** Milliseconds an authorization server request may take. */
-const TERMINAL_TIMEOUT_MS = 1e4;
-async function readJson(response) {
-	try {
-		const body = await response.json();
-		return isRecord(body) ? body : null;
-	} catch {
-		return null;
-	}
-}
-/** POSTs a form and reads a JSON object back; any network or parse failure is `null`. */
-async function postForm(runtime, url, fields) {
-	const fetchImpl = runtime.fetch ?? fetch;
-	try {
-		return await readJson(await fetchImpl(url, {
-			method: "POST",
-			headers: { "content-type": "application/x-www-form-urlencoded" },
-			body: new URLSearchParams(fields),
-			signal: timeoutSignal(TERMINAL_TIMEOUT_MS)
-		}));
-	} catch {
-		return null;
-	}
-}
-async function discoverDeviceEndpoints(issuer, runtime) {
-	const fetchImpl = runtime.fetch ?? fetch;
-	const url = issuer.endsWith("/") ? `${issuer}.well-known/oauth-authorization-server` : `${issuer}/.well-known/oauth-authorization-server`;
-	try {
-		const body = await readJson(await fetchImpl(url, { signal: timeoutSignal(TERMINAL_TIMEOUT_MS) }));
-		if (body === null) return {};
-		return compact({
-			authorizationEndpoint: typeof body["device_authorization_endpoint"] === "string" ? body["device_authorization_endpoint"] : void 0,
-			tokenEndpoint: typeof body["token_endpoint"] === "string" ? body["token_endpoint"] : void 0,
-			revocationEndpoint: typeof body["revocation_endpoint"] === "string" ? body["revocation_endpoint"] : void 0
-		});
-	} catch {
-		return {};
-	}
-}
-function parseAuthorization(body) {
-	if (typeof body["device_code"] !== "string" || typeof body["user_code"] !== "string" || typeof body["verification_uri"] !== "string" || typeof body["expires_in"] !== "number") return null;
-	return compact({
-		device_code: body["device_code"],
-		user_code: body["user_code"],
-		verification_uri: body["verification_uri"],
-		verification_uri_complete: typeof body["verification_uri_complete"] === "string" ? body["verification_uri_complete"] : void 0,
-		expires_in: body["expires_in"],
-		interval: typeof body["interval"] === "number" ? body["interval"] : void 0
-	});
-}
-function parseToken(body, now) {
-	if (typeof body["error"] === "string") return {
-		ok: false,
-		error: body["error"]
-	};
-	if (typeof body["access_token"] !== "string") return {
-		ok: false,
-		error: "invalid-token"
-	};
-	return {
-		ok: true,
-		credential: compact({
-			access_token: body["access_token"],
-			refresh_token: typeof body["refresh_token"] === "string" ? body["refresh_token"] : void 0,
-			expires_at: typeof body["expires_in"] === "number" ? now + body["expires_in"] : void 0,
-			token_type: typeof body["token_type"] === "string" ? body["token_type"] : void 0
-		})
-	};
-}
-async function runDeviceFlow(device, runtime, write) {
-	const sleep = runtime.sleep ?? defaultSleep;
-	const now = runtime.now ?? (() => Math.floor(Date.now() / 1e3));
-	let authorizationEndpoint = device.authorizationEndpoint;
-	let tokenEndpoint = device.tokenEndpoint;
-	if ((authorizationEndpoint === void 0 || tokenEndpoint === void 0) && device.issuer !== void 0) {
-		const discovered = await discoverDeviceEndpoints(device.issuer, runtime);
-		authorizationEndpoint = authorizationEndpoint ?? discovered.authorizationEndpoint;
-		tokenEndpoint = tokenEndpoint ?? discovered.tokenEndpoint;
-	}
-	if (authorizationEndpoint === void 0 || tokenEndpoint === void 0) return null;
-	const startedBody = await postForm(runtime, authorizationEndpoint, {
-		client_id: device.clientId,
-		scope: device.scope ?? ""
-	});
-	const authorization = startedBody === null ? null : parseAuthorization(startedBody);
-	if (authorization === null) return null;
-	device.onPrompt?.(compact({
-		user_code: authorization.user_code,
-		verification_uri: authorization.verification_uri,
-		verification_uri_complete: authorization.verification_uri_complete
-	}));
-	write(`Visit ${authorization.verification_uri} and enter ${authorization.user_code}\n`);
-	if (authorization.verification_uri_complete !== void 0) device.open?.(authorization.verification_uri_complete);
-	let interval = authorization.interval ?? 5;
-	const deadline = now() + authorization.expires_in;
-	while (now() < deadline) {
-		await sleep(interval * 1e3);
-		const polledBody = await postForm(runtime, tokenEndpoint, {
-			grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-			device_code: authorization.device_code,
-			client_id: device.clientId
-		});
-		if (polledBody === null) return null;
-		const token = parseToken(polledBody, now());
-		if (token.ok) return token.credential;
-		if (token.error === "slow_down") {
-			interval += 5;
-			continue;
-		}
-		if (token.error === "authorization_pending") continue;
-		return null;
-	}
-	return null;
-}
-async function refreshCredential(device, credential, runtime) {
-	if (credential.refresh_token === void 0) return null;
-	const now = runtime.now ?? (() => Math.floor(Date.now() / 1e3));
-	let tokenEndpoint = device.tokenEndpoint;
-	if (tokenEndpoint === void 0 && device.issuer !== void 0) tokenEndpoint = (await discoverDeviceEndpoints(device.issuer, runtime)).tokenEndpoint;
-	if (tokenEndpoint === void 0) return null;
-	const body = await postForm(runtime, tokenEndpoint, {
-		grant_type: "refresh_token",
-		refresh_token: credential.refresh_token,
-		client_id: device.clientId
-	});
-	if (body === null) return null;
-	const token = parseToken(body, now());
-	return token.ok ? token.credential : null;
-}
-async function revokeCredential(device, credential, runtime) {
-	if (device === void 0 || credential.refresh_token === void 0) return;
-	let revocationEndpoint = device.revocationEndpoint;
-	if (revocationEndpoint === void 0 && device.issuer !== void 0) revocationEndpoint = (await discoverDeviceEndpoints(device.issuer, runtime)).revocationEndpoint;
-	if (revocationEndpoint === void 0) return;
-	await postForm(runtime, revocationEndpoint, {
-		token: credential.refresh_token,
-		token_type_hint: "refresh_token",
-		client_id: device.clientId
-	});
-}
-function defaultSleep(ms) {
-	return new Promise((resolve) => {
-		setTimeout(resolve, ms);
-	});
-}
-//#endregion
 //#region src/terminal/exit.ts
 const EX_OK = 0;
 const EX_USAGE = 64;
@@ -269,128 +124,6 @@ function formatDecision(decision, options = {}) {
 	return `${details.detail}\n`;
 }
 //#endregion
-//#region src/terminal/storage.ts
-const FILE_MODE = 384;
-const DIR_MODE = 448;
-const GROUP_OR_WORLD = 63;
-function credentialsPath(service, runtime) {
-	if (runtime.configDir !== void 0) return path.join(runtime.configDir, "credentials.json");
-	const home = runtime.homedir ?? homedir;
-	const env = runtime.env ?? process.env;
-	if ((runtime.platform ?? process.platform) === "win32") {
-		const appData = env["APPDATA"] ?? path.join(home(), "AppData", "Roaming");
-		return path.join(appData, service, "credentials.json");
-	}
-	const xdg = env["XDG_CONFIG_HOME"] ?? path.join(home(), ".config");
-	return path.join(xdg, service, "credentials.json");
-}
-function parseCredential(value) {
-	if (!isRecord(value) || typeof value["access_token"] !== "string") return null;
-	return compact({
-		access_token: value["access_token"],
-		refresh_token: typeof value["refresh_token"] === "string" ? value["refresh_token"] : void 0,
-		expires_at: typeof value["expires_at"] === "number" ? value["expires_at"] : void 0,
-		token_type: typeof value["token_type"] === "string" ? value["token_type"] : void 0
-	});
-}
-function keyringEntry(storage, profile) {
-	if (storage.keyring === void 0) return null;
-	try {
-		return new storage.keyring(storage.service, profile);
-	} catch {
-		return null;
-	}
-}
-function readKeyring(storage, profile) {
-	const entry = keyringEntry(storage, profile);
-	if (entry === null) return null;
-	try {
-		const raw = entry.getPassword();
-		return typeof raw === "string" ? parseCredential(JSON.parse(raw)) : null;
-	} catch {
-		return null;
-	}
-}
-function readCredentials(storage, profile, runtime) {
-	return readKeyring(storage, profile) ?? readFile(storage.service, profile, runtime);
-}
-function readFile(service, profile, runtime) {
-	const file = credentialsPath(service, runtime);
-	let raw;
-	try {
-		const stat = statSync(file);
-		if ((runtime.platform ?? process.platform) !== "win32" && (stat.mode & GROUP_OR_WORLD) !== 0) return null;
-		raw = readFileSync(file, "utf8");
-	} catch {
-		return null;
-	}
-	try {
-		const parsed = JSON.parse(raw);
-		if (!isRecord(parsed) || !isRecord(parsed["profiles"])) return null;
-		return parseCredential(parsed["profiles"][profile]);
-	} catch {
-		return null;
-	}
-}
-/** The OS keychain when `storage.keyring` is set and works; otherwise the mode-0600 file. */
-function writeCredentials(storage, profile, credential, runtime) {
-	const entry = keyringEntry(storage, profile);
-	if (entry !== null) try {
-		entry.setPassword(JSON.stringify(credential));
-		deleteFile(storage.service, profile, runtime);
-		return;
-	} catch {}
-	writeFile(storage.service, profile, credential, runtime);
-}
-function writeFile(service, profile, credential, runtime) {
-	const file = credentialsPath(service, runtime);
-	mkdirSync(path.dirname(file), {
-		recursive: true,
-		mode: DIR_MODE
-	});
-	let profiles = {};
-	try {
-		const existing = JSON.parse(readFileSync(file, "utf8"));
-		if (isRecord(existing) && isRecord(existing["profiles"])) profiles = existing["profiles"];
-	} catch {
-		profiles = {};
-	}
-	profiles[profile] = credential;
-	writeFileSync(file, `${JSON.stringify({ profiles }, null, 2)}\n`, {
-		encoding: "utf8",
-		mode: FILE_MODE
-	});
-}
-function deleteCredentials(storage, profile, runtime) {
-	const entry = keyringEntry(storage, profile);
-	if (entry !== null) try {
-		entry.deletePassword();
-	} catch {}
-	deleteFile(storage.service, profile, runtime);
-}
-function deleteFile(service, profile, runtime) {
-	const file = credentialsPath(service, runtime);
-	let parsed;
-	try {
-		parsed = JSON.parse(readFileSync(file, "utf8"));
-	} catch {
-		return;
-	}
-	if (!isRecord(parsed) || !isRecord(parsed["profiles"])) return;
-	const profiles = {};
-	for (const key of Object.keys(parsed["profiles"])) if (key !== profile) profiles[key] = parsed["profiles"][key];
-	if (Object.keys(profiles).length === 0) {
-		try {
-			unlinkSync(file);
-		} catch {}
-		return;
-	}
-	writeFileSync(file, `${JSON.stringify({ profiles }, null, 2)}\n`, {
-		encoding: "utf8",
-		mode: FILE_MODE
-	});
-}
-//#endregion
 //#region src/terminal/token.ts
 const JWT_PART = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/u;
 function looksLikeJwt(value) {
@@ -430,10 +163,12 @@ async function fromCiOidc(runtime, source) {
 	if (typeof env["ACTIONS_ID_TOKEN_REQUEST_URL"] === "string" && typeof env["ACTIONS_ID_TOKEN_REQUEST_TOKEN"] === "string") try {
 		const url = new URL(env["ACTIONS_ID_TOKEN_REQUEST_URL"]);
 		if (audience !== void 0) url.searchParams.set("audience", audience);
-		const body = await (await fetchImpl(url, {
+		const response = await fetchImpl(url, {
 			headers: { Authorization: `Bearer ${env["ACTIONS_ID_TOKEN_REQUEST_TOKEN"]}` },
 			signal: timeoutSignal(TERMINAL_TIMEOUT_MS)
-		})).json();
+		});
+		const text = await readBodyText(response);
+		const body = text.ok ? JSON.parse(text.text) : null;
 		if (body !== null && typeof body === "object" && "value" in body && typeof body.value === "string") return body.value;
 	} catch {
 		return null;
@@ -442,7 +177,7 @@ async function fromCiOidc(runtime, source) {
 }
 async function resolveToken(sources, options) {
 	const walk = options.force === void 0 ? sources : [options.force];
-	const now = options.runtime.now ?? (() => Math.floor(Date.now() / 1e3));
+	const now = () => secondsAt(options.runtime.now?.());
 	for (const source of walk) {
 		const name = sourceName(source);
 		switch (name) {
@@ -573,7 +308,8 @@ const defaultTyped = (input) => {
 		});
 	});
 };
-function createPermDock(policy, options) {
+function createPermDock(policy, given) {
+	const options = withApp(policy, given);
 	const write = writeOf(options);
 	const exit = options.runtime?.exit ?? defaultExit;
 	const runtime = compact({
@@ -615,7 +351,7 @@ function createPermDock(policy, options) {
 		last = built;
 		return built;
 	};
-	const permdock = (resolveOptions = {}) => {
+	const getPermDock = (resolveOptions = {}) => {
 		if (resolveOptions.refresh === true || cached === void 0) cached = resolve(resolveOptions);
 		return cached;
 	};
@@ -637,7 +373,7 @@ function createPermDock(policy, options) {
 		let decide;
 		let first;
 		try {
-			instance = await permdock();
+			instance = await getPermDock();
 			if (load !== void 0) {
 				data = await load(...args);
 				if (permission.kind === "instance" && (data === null || data === void 0)) {
@@ -650,10 +386,10 @@ function createPermDock(policy, options) {
 			}
 			decide = instance.decide;
 			first = decide(permission, data, dryRun ? {
-				source: "simulate",
+				call: "simulate",
 				adapter: "terminal"
 			} : {
-				source: "adapter",
+				call: "adapter",
 				adapter: "terminal"
 			});
 		} catch {
@@ -710,7 +446,7 @@ function createPermDock(policy, options) {
 				return exit(77);
 			}
 			const again = decide(permission, data, compact({
-				source: "adapter",
+				call: "adapter",
 				adapter: "terminal"
 			}));
 			if (again.outcome === "denied") {
@@ -805,7 +541,7 @@ function createPermDock(policy, options) {
 		last = void 0;
 	};
 	return {
-		permdock,
+		getPermDock,
 		protect,
 		filterCommands,
 		format,