pi-harness-runtime 1.1.445 → 1.1.446

package/scripts/npm-unpublish-with-approval.sh

@@ -1,268 +0,0 @@
-#!/usr/bin/env bash
-#
-# Remove published versions, completing a web-auth approval when the npm
-# registry asks for one.
-#
-# The registry can refuse a write with an EOTP challenge that carries a
-# browser approval URL and a polling URL. The approval URL embeds
-# credential material, so it must never reach a log - a log line is
-# masked, which would leave the operator with nothing to open, and a
-# public artifact would publish the token. The approval therefore happens
-# where the URL can be seen safely: a terminal.
-#
-# Modes:
-#
-#   request <package> <version>
-#     Attempts the removal. On a challenge it prints the approval link
-#     and exits 42.
-#
-#   wait <package> <version> <seconds>
-#     Polls the registry until the approval lands, writes the approved
-#     token into the npmrc, and exits 0. The caller retries "request".
-#
-#   batch <package> <version> [version ...]
-#     Runs the whole list, handling an approval inline: it prints the
-#     link, waits for the approval, refreshes the credential and carries
-#     on.
-#
-# Exit codes: 0 removed, 1 failed, 42 a browser approval is needed.
-#
-# The credential comes from the npmrc, or from the key file
-# ~/.pi-harness-runtime/keys/npm-token.txt when one exists. It is never
-# printed.
-
-set -uo pipefail
-
-APPROVAL_DIR=/tmp/npm-approval
-NPMRC="${NPM_CONFIG_USERCONFIG:-${HOME:-/tmp}/.npmrc}"
-ERR_FILE=/tmp/npm-approval-error.txt
-TOKEN_FILE="${NPM_TOKEN_FILE:-$HOME/.pi-harness-runtime/keys/npm-token.txt}"
-
-# The registry hands the approved token back in the body of the polling
-# response. That body is a credential, so it is written inside the
-# approval directory, readable by its owner only, and removed as soon as
-# the token has been read. A file in /tmp that survives the run leaves a
-# usable npm credential behind on a shared machine.
-APPROVAL_BODY="${APPROVAL_DIR}/done-body.json"
-
-# The credential must exist somewhere before npm is called.
-ensure_credential() {
-	if [ -s "$NPMRC" ] && grep -q "_authToken=" "$NPMRC"; then
-		echo "credential: the npmrc"
-		return 0
-	fi
-	if [ -s "$TOKEN_FILE" ]; then
-		umask 077
-		mkdir -p "$(dirname "$NPMRC")"
-		touch "$NPMRC"
-		grep -v '_authToken=' "$NPMRC" > "$NPMRC.tmp" || true
-		printf '//registry.npmjs.org/:_authToken=%s\n' \
-			"$(tr -d '\n' < "$TOKEN_FILE")" >> "$NPMRC.tmp"
-		mv "$NPMRC.tmp" "$NPMRC"
-		echo "credential: the key file"
-		return 0
-	fi
-	echo "no credential: sign in with npm, or set the key file" >&2
-	return 1
-}
-
-auth_url_from_error() {
-	grep -oE 'https://www[.]npmjs[.]com/auth/cli/[A-Za-z0-9._~-]+' "$ERR_FILE" | head -1
-}
-
-# The polling URL is the registry's, or a loopback stand-in in a test.
-# The host stays pinned so a forged URL cannot redirect the poll.
-done_url_from_error() {
-	grep -oE '(https://registry[.]npmjs[.]org|http://127[.]0[.]0[.]1(:[0-9]+)?)/-/v1/done[?]authId=[A-Za-z0-9._~-]+' "$ERR_FILE" | head -1
-}
-
-write_token_to_npmrc() {
-	local token="$1"
-	umask 077
-	mkdir -p "$(dirname "$NPMRC")"
-	touch "$NPMRC"
-	# Keep every other setting: only the token line is replaced.
-	grep -v '_authToken=' "$NPMRC" > "$NPMRC.tmp" || true
-	printf '//registry.npmjs.org/:_authToken=%s\n' "$token" >> "$NPMRC.tmp"
-	mv "$NPMRC.tmp" "$NPMRC"
-}
-
-# Attempt one removal. Sets APPROVAL_URL and DONE_URL when the registry
-# asks for a browser approval.
-attempt_removal() {
-	local package="$1" version="$2"
-	APPROVAL_URL=""
-	DONE_URL=""
-	if [ -n "${NPM_OTP:-}" ]; then
-		npm unpublish --otp="${NPM_OTP}" "${package}@${version}" \
-			>/dev/null 2>"$ERR_FILE"
-	else
-		npm unpublish "${package}@${version}" >/dev/null 2>"$ERR_FILE"
-	fi
-	local rc=$?
-	if [ $rc -eq 0 ]; then
-		return 0
-	fi
-	APPROVAL_URL="$(auth_url_from_error)"
-	DONE_URL="$(done_url_from_error)"
-	if [ -n "$APPROVAL_URL" ] && [ -n "$DONE_URL" ]; then
-		mkdir -p "$APPROVAL_DIR"
-		printf '%s' "$APPROVAL_URL" > "$APPROVAL_DIR/url.txt"
-		printf '%s' "$DONE_URL" > "$APPROVAL_DIR/done-url.txt"
-		return 42
-	fi
-	# The registry may also ask for a typed one-time code. The prompt
-	# was captured, so the retry runs with the terminal attached.
-	if grep -qiE 'one-time password|enter otp' "$ERR_FILE"; then
-		echo "the registry asked for a one-time code"
-		if [ -n "${NPM_OTP:-}" ]; then
-			npm unpublish --otp="${NPM_OTP}" "${package}@${version}"
-		else
-			npm unpublish "${package}@${version}"
-		fi
-		rc=$?
-		if [ $rc -eq 0 ]; then
-			return 0
-		fi
-	fi
-	return 1
-}
-
-# Wait for the approval to land and refresh the credential.
-wait_for_approval() {
-	local done_url="$1" wait_seconds="$2"
-	local deadline=$(( $(date +%s) + wait_seconds ))
-	while [ "$(date +%s)" -lt "$deadline" ]; do
-		local code token
-		umask 077
-		mkdir -p "$APPROVAL_DIR"
-		code="$(curl -sS -o "$APPROVAL_BODY" -w '%{http_code}' \
-			-H "Authorization: Bearer ${NODE_AUTH_TOKEN:-}" "$done_url")"
-		if [ "$code" = "200" ]; then
-			token="$(node -e '
-				const fs = require("fs");
-				let c = {};
-				try { c = JSON.parse(fs.readFileSync(process.argv[1], "utf8")); }
-				catch {}
-				process.stdout.write(c.token || "");
-			' "$APPROVAL_BODY")"
-			# The body is a credential: it does not outlive the read.
-			rm -f "$APPROVAL_BODY"
-			if [ -n "$token" ]; then
-				write_token_to_npmrc "$token"
-				echo "the approval landed; the credential was refreshed"
-				return 0
-			fi
-		fi
-		sleep 5
-	done
-	rm -f "$APPROVAL_BODY"
-	echo "no approval arrived within ${wait_seconds}s"
-	return 1
-}
-
-print_approval_link() {
-	echo ""
-	echo "The npm registry wants a browser approval before it removes"
-	echo "a version. Open this link, sign in to npm if needed, and approve:"
-	echo ""
-	echo "    $1"
-	echo ""
-	echo "The removal continues on its own once the approval lands."
-	echo ""
-}
-
-MODE="${1:?mode required}"
-shift
-
-case "$MODE" in
-request)
-	PACKAGE="${1:?package name required}"
-	VERSION="${2:?version required}"
-	ensure_credential || exit 1
-	attempt_removal "$PACKAGE" "$VERSION"
-	rc=$?
-	case $rc in
-	0)
-		echo "OK: unpublished ${PACKAGE}@${VERSION}"
-		exit 0
-		;;
-	42)
-		print_approval_link "$APPROVAL_URL"
-		exit 42
-		;;
-	*)
-		echo "FAILED: ${PACKAGE}@${VERSION}"
-		grep -v -E 'auth/cli|v1/done' "$ERR_FILE" | tail -5
-		exit 1
-		;;
-	esac
-	;;
-wait)
-	PACKAGE="${1:?package name required}"
-	VERSION="${2:?version required}"
-	WAIT_SECONDS="${3:-900}"
-	DONE_URL="$(cat "$APPROVAL_DIR/done-url.txt" 2>/dev/null || true)"
-	if [ -z "$DONE_URL" ]; then
-		echo "no pending approval to wait for"
-		exit 1
-	fi
-	wait_for_approval "$DONE_URL" "$WAIT_SECONDS"
-	exit $?
-	;;
-batch)
-	PACKAGE="${1:?package name required}"
-	shift
-	ensure_credential || exit 1
-	failed=""
-	for version in "$@"; do
-		attempt_removal "$PACKAGE" "$version"
-		rc=$?
-		if [ $rc -eq 0 ]; then
-			echo "OK: unpublished ${PACKAGE}@${version}"
-			continue
-		fi
-		if [ $rc -ne 42 ]; then
-			echo "FAILED: ${PACKAGE}@${version}"
-			grep -v -E 'auth/cli|v1/done' "$ERR_FILE" | tail -5
-			failed="$failed $version"
-			continue
-		fi
-		print_approval_link "$APPROVAL_URL"
-		if ! wait_for_approval "$DONE_URL" "${APPROVAL_WAIT:-900}"; then
-			echo "FAILED: ${PACKAGE}@${version}"
-			failed="$failed $version"
-			# An approval that does not arrive means nobody is watching this
-			# run. Every remaining version would face the same challenge and
-			# wait the same fifteen minutes, so the batch stops here
-			# instead of spending hours to remove nothing. Set
-			# APPROVAL_ABORT=0 to keep going anyway.
-			if [ "${APPROVAL_ABORT:-1}" != "0" ]; then
-				echo ""
-				echo "The approval did not arrive, so the batch stops."
-				echo "The versions that were not attempted are still published."
-				echo "Run this again once the approval can be given."
-				break
-			fi
-			continue
-		fi
-		attempt_removal "$PACKAGE" "$version"
-		rc=$?
-		if [ $rc -eq 0 ]; then
-			echo "OK: unpublished ${PACKAGE}@${version}"
-		else
-			echo "FAILED: ${PACKAGE}@${version}"
-			failed="$failed $version"
-		fi
-	done
-	if [ -n "$failed" ]; then
-		echo "Versions that could not be unpublished:$failed"
-		exit 1
-	fi
-	exit 0
-	;;
-*)
-	echo "unknown mode: $MODE" >&2
-	exit 2
-	;;
-esac

package/scripts/npm-verify-removal.mjs

@@ -1,302 +0,0 @@
-#!/usr/bin/env node
-/**
- * Verify that an npm removal actually happened.
- *
- * The removal itself is irreversible, so the report that follows it has to
- * be trustworthy. The obvious way to check - ask the registry for one
- * version at a time and treat a non-zero exit as "the version is gone" -
- * cannot tell "the version is gone" from "the registry did not answer".
- * A network hiccup during the check therefore reads as a successful
- * removal, and the operator is told the private content is gone while it
- * is still published.
- *
- * This verifier separates the two.
- *
- * What it proves, for a version that should be gone:
- *
- *   1. The version is absent from the packument's version map. The
- *      packument keeps a `time` entry that still names a removed version,
- *      so the version map - not the whole document - is the criterion.
- *   2. The tarball answers 404. The packument entry is the listing; the
- *      tarball is the content. Only the second one proves that the
- *      private content is no longer downloadable.
- *
- * What it proves, for a version that should remain:
- *
- *   1. The version is still in the version map.
- *
- * What it proves, for a dist-tag:
- *
- *   1. The tag still points at the version it pointed at before.
- *
- * Exit codes:
- *
- *   0  everything the spec asks for was proven.
- *   1  the spec was not met: a version is still published, a version is
- *      missing, or a dist-tag moved.
- *   2  the state could not be established. The registry was unreachable
- *      or answered something unexpected. This is NOT a pass, and it is
- *      deliberately not the same code as a failure, because "I could not
- *      check" and "the check failed" call for different responses.
- *
- * The check reads the registry without a credential. It therefore proves
- * what an anonymous reader can see, which is exactly the exposure that
- * matters here.
- *
- * Usage:
- *
- *   node scripts/npm-verify-removal.mjs <package> <spec.json>
- *   node scripts/npm-verify-removal.mjs <package> --capture <spec.json> <version> [version ...]
- *
- * The capture form records the state that the check will later prove: the
- * versions to remove, every other published version as one to keep, and
- * the dist-tags as they are at that moment. Capturing before the removal
- * is what makes the later check meaningful - a spec written by hand can
- * describe a state that was never the real one.
- *
- * The spec is a JSON document:
- *
- *   {
- *     "gone": ["1.1.390", "1.1.391"],
- *     "keep": ["1.1.425"],
- *     "tags": { "latest": "1.1.433" }
- *   }
- *
- * Every section is optional. The registry comes from
- * npm_config_registry, so a test can point it at a local server.
- */
-
-import { readFile, writeFile } from "node:fs/promises";
-
-const REGISTRY = (process.env.npm_config_registry || "https://registry.npmjs.org").replace(/\/+$/, "");
-
-/**
- * The number of tarball probes that run at once. Each probe is a HEAD
- * against a different URL, so the limit is about the registry's patience
- * rather than this process's memory.
- */
-const PROBE_CONCURRENCY = 6;
-
-async function main() {
-	const args = process.argv.slice(2);
-	const packageName = args[0];
-	if (!packageName) {
-		process.stderr.write("usage: npm-verify-removal.mjs <package> <spec.json>\n");
-		process.stderr.write("       npm-verify-removal.mjs <package> --capture <spec.json> <version> [version ...]\n");
-		return 2;
-	}
-
-	// The capture form records the current state instead of checking it.
-	if (args[1] === "--capture") {
-		const [, , specPath, ...gone] = args;
-		if (!specPath || gone.length === 0) {
-			process.stderr.write("usage: npm-verify-removal.mjs <package> --capture <spec.json> <version> [version ...]\n");
-			return 2;
-		}
-		return capture(packageName, specPath, gone);
-	}
-
-	const specPath = args[1];
-	if (!specPath) {
-		process.stderr.write("usage: npm-verify-removal.mjs <package> <spec.json>\n");
-		return 2;
-	}
-
-	let spec;
-	try {
-		spec = JSON.parse(await readFile(specPath, "utf8"));
-	} catch (error) {
-		process.stderr.write(`could not read the spec: ${error.message}\n`);
-		return 2;
-	}
-
-	const gone = spec.gone ?? [];
-	const keep = spec.keep ?? [];
-	const tags = spec.tags ?? {};
-
-	// One request for the whole packument. Asking per version would be
-	// 31 requests for a 31-version removal, and the whole document is
-	// what every check below needs.
-	let packument;
-	try {
-		const response = await fetch(packumentUrl(packageName));
-		if (!response.ok) {
-			process.stdout.write(`could not verify: the registry answered ${response.status} for the packument\n`);
-			return 2;
-		}
-		packument = await response.json();
-	} catch (error) {
-		process.stdout.write(`could not verify: the registry could not be reached (${error.message})\n`);
-		return 2;
-	}
-
-	const published = new Set(Object.keys(packument.versions ?? {}));
-	const failures = [];
-
-	// The versions that should be gone.
-	const stillPublished = gone.filter((version) => published.has(version));
-	for (const version of stillPublished) {
-		failures.push(`still published: ${version}`);
-	}
-
-	// The versions that should remain.
-	const missing = keep.filter((version) => !published.has(version));
-	for (const version of missing) {
-		failures.push(`missing: ${version}`);
-	}
-
-	// The dist-tags, which must not have moved.
-	const currentTags = packument["dist-tags"] ?? {};
-	for (const [name, expected] of Object.entries(tags)) {
-		const actual = currentTags[name];
-		if (actual !== expected) {
-			failures.push(`dist-tag ${name} points at ${actual ?? "(unset)"}, expected ${expected}`);
-		}
-	}
-
-	// The tarballs. A removed version must not be downloadable.
-	const probes = await mapLimit(
-		gone.filter((version) => !published.has(version)),
-		PROBE_CONCURRENCY,
-		(version) => probeTarball(packageName, version),
-	);
-	let unknown = 0;
-	for (const [version, result] of probes) {
-		if (result === "gone") continue;
-		if (result === "alive") {
-			failures.push(`the tarball is still downloadable: ${version}`);
-		} else {
-			unknown++;
-			failures.push(`could not determine the tarball state: ${version}`);
-		}
-	}
-
-	// The report.
-	process.stdout.write(`package: ${packageName}\n`);
-	process.stdout.write(`registry: ${REGISTRY}\n`);
-	process.stdout.write(`published versions: ${published.size}\n`);
-	process.stdout.write(`expected gone: ${gone.length}, expected to remain: ${keep.length}\n`);
-	if (Object.keys(tags).length > 0) {
-		const shown = Object.entries(tags)
-			.map(([name, value]) => `${name}=${value}`)
-			.join(", ");
-		process.stdout.write(`dist-tags checked: ${shown}\n`);
-	}
-
-	if (unknown > 0) {
-		process.stdout.write(`could not verify: ${unknown} tarball probe(s) did not answer\n`);
-		return 2;
-	}
-	if (failures.length > 0) {
-		process.stdout.write("not verified:\n");
-		for (const failure of failures) process.stdout.write(`  ${failure}\n`);
-		return 1;
-	}
-
-	process.stdout.write("verified:\n");
-	process.stdout.write(`  every one of the ${gone.length} removed version(s) is absent and its tarball answers 404\n`);
-	process.stdout.write(`  every one of the ${keep.length} retained version(s) is still published\n`);
-	if (Object.keys(tags).length > 0) process.stdout.write("  every dist-tag still points where it did\n");
-	return 0;
-}
-
-/**
- * Record the state that a later check will prove.
- *
- * Every published version that is not on the removal list is recorded as
- * one to keep, and the dist-tags are recorded as they are now. A spec
- * that was written by hand can describe a state that was never the real
- * one; a captured one cannot.
- */
-async function capture(packageName, specPath, gone) {
-	let packument;
-	try {
-		const response = await fetch(packumentUrl(packageName));
-		if (!response.ok) {
-			process.stdout.write(`could not capture: the registry answered ${response.status} for the packument\n`);
-			return 2;
-		}
-		packument = await response.json();
-	} catch (error) {
-		process.stdout.write(`could not capture: the registry could not be reached (${error.message})\n`);
-		return 2;
-	}
-
-	const published = Object.keys(packument.versions ?? {});
-	const removing = new Set(gone);
-	const keep = published.filter((version) => !removing.has(version));
-	const spec = {
-		gone: [...removing],
-		keep,
-		tags: packument["dist-tags"] ?? {},
-	};
-	await writeFile(specPath, `${JSON.stringify(spec, null, 2)}\n`);
-
-	process.stdout.write(`captured the registry state into ${specPath}\n`);
-	process.stdout.write(`  to remove: ${spec.gone.length}\n`);
-	process.stdout.write(`  to keep:  ${spec.keep.length}\n`);
-	const shown = Object.entries(spec.tags)
-		.map(([name, value]) => `${name}=${value}`)
-		.join(", ");
-	if (shown) process.stdout.write(`  dist-tags: ${shown}\n`);
-	return 0;
-}
-
-/**
- * The packument URL. A scoped name is encoded so the registry reads it
- * as one package rather than a path.
- */
-function packumentUrl(packageName) {
-	const encoded = packageName.startsWith("@") ? packageName.replace("/", "%2f") : packageName;
-	return `${REGISTRY}/${encoded}`;
-}
-
-/**
- * The tarball URL. npm names the file after the package without its
- * scope, so `@scope/name` publishes `name-<version>.tgz`.
- */
-function tarballUrl(packageName, version) {
-	const bare = packageName.startsWith("@") ? packageName.slice(packageName.indexOf("/") + 1) : packageName;
-	return `${REGISTRY}/${packageName}/-/${bare}-${version}.tgz`;
-}
-
-/**
- * Probe one tarball. A HEAD is enough: the registry answers it with the
- * same status it gives the GET, without moving the body.
- *
- * The three answers are kept apart on purpose:
- *
- *   "gone"   the registry answered 404. The content is not downloadable.
- *   "alive"  the registry answered 200. The content is still there.
- *   "unknown" the registry did not answer. Nothing was proven.
- */
-async function probeTarball(packageName, version) {
-	try {
-		const response = await fetch(tarballUrl(packageName, version), { method: "HEAD" });
-		if (response.status === 404) return "gone";
-		if (response.status === 200) return "alive";
-		return "unknown";
-	} catch {
-		return "unknown";
-	}
-}
-
-/**
- * Run an async worker over a list with a bounded number in flight.
- */
-async function mapLimit(items, limit, worker) {
-	const results = [];
-	let next = 0;
-	const runner = async () => {
-		while (next < items.length) {
-			const index = next++;
-			results[index] = [items[index], await worker(items[index])];
-		}
-	};
-	const runners = [];
-	for (let i = 0; i < Math.min(limit, items.length); i++) runners.push(runner());
-	await Promise.all(runners);
-	return results;
-}
-
-process.exit(await main());