poe-code 4.0.20 → 4.0.21

package/dist/index.js

@@ -69270,6 +69270,35 @@ var init_authorization_state2 = __esm({
 
 // packages/poe-oauth/src/loopback-authorization.ts
 import http2 from "node:http";
+function validateOAuthAuthorizationCallback(options) {
+  let url;
+  try {
+    url = typeof options.callbackUrl === "string" ? new URL(options.callbackUrl) : options.callbackUrl;
+  } catch {
+    throw new Error("Poe OAuth callbackUrl must be an absolute URL.");
+  }
+  const callback = {
+    code: url.searchParams.get("code"),
+    state: url.searchParams.get("state"),
+    iss: url.searchParams.get("iss")
+  };
+  const expected = {
+    state: validateExpectedState(options.expectedState),
+    issuer: options.expectedIssuer ?? null,
+    requireIssuer: options.requireIssuer ?? false
+  };
+  validateAuthorizationCallbackBinding2(callback, expected);
+  const authorizationError = url.searchParams.get("error");
+  if (authorizationError !== null) {
+    const description = url.searchParams.get("error_description");
+    const safeError = sanitizeAuthorizationError(authorizationError, expected.state);
+    const safeDescription = description === null ? null : sanitizeAuthorizationError(description, expected.state);
+    throw new Error(
+      safeDescription === null ? `OAuth authorization failed: ${safeError}` : `OAuth authorization failed: ${safeError} \u2014 ${safeDescription}`
+    );
+  }
+  return validateAuthorizationCallbackParameters2(callback, expected);
+}
 async function createLoopbackAuthorizationSession2(options = {}) {
   const callbackPath = options.callbackPath ?? "/callback";
   const server = options.createServer ? options.createServer() : http2.createServer();
@@ -69316,45 +69345,24 @@ function waitForAuthorizationCode2(server, authorizationUrl, options, callbackPa
         res.end("Not found");
         return;
       }
-      const error3 = url.searchParams.get("error");
-      if (error3 !== null) {
-        try {
-          validateAuthorizationCallbackBinding2(
-            {
-              state: url.searchParams.get("state"),
-              iss: url.searchParams.get("iss")
-            },
-            expectedAuthorization
-          );
-        } catch (validationError) {
-          res.writeHead(400);
-          res.end(
-            validationError instanceof Error ? validationError.message : "Invalid OAuth callback"
-          );
-          return;
-        }
-        const description = url.searchParams.get("error_description") ?? error3;
-        res.writeHead(400);
-        res.end(`Authorization failed: ${description}`);
-        settle(() => reject(new Error(`OAuth authorization failed: ${error3} \u2014 ${description}`)));
-        return;
-      }
       try {
-        const code = validateAuthorizationCallbackParameters2(
-          {
-            code: url.searchParams.get("code"),
-            state: url.searchParams.get("state"),
-            iss: url.searchParams.get("iss")
-          },
-          expectedAuthorization
-        );
+        const code = validateOAuthAuthorizationCallback({
+          callbackUrl: url,
+          expectedState: expectedAuthorization.state ?? "",
+          expectedIssuer: expectedAuthorization.issuer ?? void 0,
+          requireIssuer: expectedAuthorization.requireIssuer
+        });
         res.writeHead(200, { "Content-Type": "text/html" });
         res.end(buildSuccessPage2(options.landingPage));
         settle(() => resolve16(code));
-      } catch (error4) {
+      } catch (error3) {
+        const validationError = error3 instanceof Error ? error3 : new Error(String(error3));
         res.writeHead(400);
-        res.end(error4 instanceof Error ? error4.message : "Invalid OAuth callback");
-        settle(() => reject(error4 instanceof Error ? error4 : new Error(String(error4))));
+        res.end(validationError.message);
+        if (url.searchParams.has("error") && !validationError.message.startsWith("OAuth authorization failed:")) {
+          return;
+        }
+        settle(() => reject(validationError));
       }
     });
     if (options.readLine !== void 0) {
@@ -69439,6 +69447,18 @@ function validateAuthorizationCallbackBinding2(callback, expected) {
     throw new Error("OAuth callback issuer mismatch");
   }
 }
+function validateExpectedState(state) {
+  if (state.length === 0 || state.trim() !== state) {
+    throw new Error("Poe OAuth expectedState must not be blank or contain surrounding whitespace.");
+  }
+  return state;
+}
+function sanitizeAuthorizationError(value, expectedState) {
+  if (value.includes(expectedState)) {
+    return "authorization_error";
+  }
+  return value;
+}
 function escapeHtml4(text5) {
   return text5.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 }
@@ -69468,7 +69488,33 @@ function generateCodeVerifier2() {
   return crypto7.randomBytes(32).toString("base64url");
 }
 function generateCodeChallenge2(verifier) {
-  return crypto7.createHash("sha256").update(verifier).digest("base64url");
+  return crypto7.createHash("sha256").update(validateCodeVerifier(verifier)).digest("base64url");
+}
+function validateCodeVerifier(verifier) {
+  if (verifier.length < 43 || verifier.length > 128 || !hasOnlyPkceCharacters(verifier)) {
+    throw new Error(
+      "Poe OAuth codeVerifier must contain 43 to 128 URL-safe PKCE characters."
+    );
+  }
+  return verifier;
+}
+function validateCodeChallenge(challenge) {
+  if (challenge.length !== 43 || !hasOnlyPkceCharacters(challenge)) {
+    throw new Error("Poe OAuth codeChallenge must contain 43 URL-safe PKCE characters.");
+  }
+  return challenge;
+}
+function hasOnlyPkceCharacters(value) {
+  for (const character of value) {
+    const code = character.charCodeAt(0);
+    const isDigit6 = code >= 48 && code <= 57;
+    const isUppercase = code >= 65 && code <= 90;
+    const isLowercase = code >= 97 && code <= 122;
+    if (!isDigit6 && !isUppercase && !isLowercase && character !== "-" && character !== "_") {
+      return false;
+    }
+  }
+  return true;
 }
 var init_pkce2 = __esm({
   "packages/poe-oauth/src/pkce.ts"() {
@@ -69482,7 +69528,15 @@ function createOAuthClient(config2) {
   const clientId = validateClientId(config2.clientId);
   const normalizedConfig = {
     ...config2,
-    clientId
+    clientId,
+    authorizationEndpoint: validateHttpUrl(
+      config2.authorizationEndpoint ?? DEFAULT_AUTHORIZATION_ENDPOINT,
+      "authorizationEndpoint"
+    ),
+    tokenEndpoint: validateHttpUrl(
+      config2.tokenEndpoint ?? DEFAULT_TOKEN_ENDPOINT,
+      "tokenEndpoint"
+    )
   };
   return {
     authorize: () => startAuthorization(normalizedConfig, fetchFn)
@@ -69506,8 +69560,8 @@ async function startAuthorization(config2, fetchFn) {
     }
   });
   const redirectUri = loopbackSession.redirectUri;
-  const authorizationUrl = buildAuthorizationUrl2({
-    endpoint: authorizationEndpoint,
+  const authorizationUrl = createOAuthAuthorizationUrl({
+    authorizationEndpoint,
     clientId: config2.clientId,
     redirectUri,
     codeChallenge,
@@ -69521,13 +69575,13 @@ async function startAuthorization(config2, fetchFn) {
     resultPromise ??= (async () => {
       try {
         const code = await loopbackSession.waitForCode(authorizationUrl);
-        return await exchangeCodeForApiKey({
+        return await exchangeOAuthCode({
           tokenEndpoint,
           code,
           codeVerifier,
           clientId: config2.clientId,
           redirectUri,
-          fetchFn
+          fetch: fetchFn
         });
       } finally {
         loopbackSession.close();
@@ -69537,40 +69591,65 @@ async function startAuthorization(config2, fetchFn) {
   };
   return { authorizationUrl, waitForResult: waitForResult3 };
 }
-function buildAuthorizationUrl2(params) {
-  const url = new URL(params.endpoint);
+function createOAuthAuthorizationUrl(options) {
+  const clientId = validateClientId(options.clientId);
+  const redirectUri = validateHttpUrl(options.redirectUri, "redirectUri");
+  const state = validateOpaqueValue(options.state, "state");
+  const codeChallenge = validateCodeChallenge(options.codeChallenge);
+  const authorizationEndpoint = validateHttpUrl(
+    options.authorizationEndpoint ?? DEFAULT_AUTHORIZATION_ENDPOINT,
+    "authorizationEndpoint"
+  );
+  const url = new URL(authorizationEndpoint);
   url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", params.clientId);
+  url.searchParams.set("client_id", clientId);
   url.searchParams.set("scope", "apikey:create");
-  url.searchParams.set("code_challenge", params.codeChallenge);
+  url.searchParams.set("code_challenge", codeChallenge);
   url.searchParams.set("code_challenge_method", "S256");
-  url.searchParams.set("redirect_uri", params.redirectUri);
-  url.searchParams.set("state", params.state);
+  url.searchParams.set("redirect_uri", redirectUri);
+  url.searchParams.set("state", state);
   return url.toString();
 }
-async function exchangeCodeForApiKey(params) {
+async function exchangeOAuthCode(options) {
+  const clientId = validateClientId(options.clientId);
+  const redirectUri = validateHttpUrl(options.redirectUri, "redirectUri");
+  const code = validateOpaqueValue(options.code, "code");
+  const codeVerifier = validateCodeVerifier(options.codeVerifier);
+  const tokenEndpoint = validateHttpUrl(
+    options.tokenEndpoint ?? DEFAULT_TOKEN_ENDPOINT,
+    "tokenEndpoint"
+  );
+  const fetchFn = options.fetch ?? globalThis.fetch;
   const body = new URLSearchParams({
     grant_type: "authorization_code",
-    code: params.code,
-    code_verifier: params.codeVerifier,
-    client_id: params.clientId,
-    redirect_uri: params.redirectUri
-  });
-  const response = await params.fetchFn(params.tokenEndpoint, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: body.toString()
+    code,
+    code_verifier: codeVerifier,
+    client_id: clientId,
+    redirect_uri: redirectUri
   });
+  let response;
+  try {
+    response = await fetchFn(tokenEndpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: body.toString()
+    });
+  } catch {
+    throw new Error("Token exchange request failed");
+  }
   if (!response.ok) {
     const text5 = await response.text();
     const description = parseErrorDescription(text5);
-    throw new Error(description ?? `Token exchange failed (${response.status}): ${text5}`);
+    if (description !== null && !description.includes(codeVerifier) && !description.includes(code)) {
+      throw new Error(description);
+    }
+    throw new Error(`Token exchange failed (${response.status})`);
   }
   let value;
   try {
     value = await response.json();
   } catch (error3) {
-    throw new Error(`Token exchange failed: invalid JSON response from ${params.tokenEndpoint}`, {
+    throw new Error(`Token exchange failed: invalid JSON response from ${tokenEndpoint}`, {
       cause: error3
     });
   }
@@ -69626,6 +69705,27 @@ function validateClientId(clientId) {
   }
   return clientId;
 }
+function validateHttpUrl(value, field) {
+  if (value.trim() !== value || value.length === 0) {
+    throw new Error(`Poe OAuth ${field} must be an absolute HTTP(S) URL.`);
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`Poe OAuth ${field} must be an absolute HTTP(S) URL.`);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:" || url.hash.length > 0) {
+    throw new Error(`Poe OAuth ${field} must be an absolute HTTP(S) URL without a fragment.`);
+  }
+  return url.toString();
+}
+function validateOpaqueValue(value, field) {
+  if (value.length === 0 || value.trim() !== value) {
+    throw new Error(`Poe OAuth ${field} must not be blank or contain surrounding whitespace.`);
+  }
+  return value;
+}
 function isValidExpiresIn(value) {
   if (typeof value !== "number" || !Number.isFinite(value) || !Number.isInteger(value) || value < 0) {
     return false;
@@ -69652,6 +69752,8 @@ var init_src30 = __esm({
     "use strict";
     init_check_auth();
     init_oauth_client();
+    init_loopback_authorization2();
+    init_pkce2();
   }
 });
 
@@ -151176,7 +151278,7 @@ var init_package2 = __esm({
   "package.json"() {
     package_default2 = {
       name: "poe-code",
-      version: "4.0.20",
+      version: "4.0.21",
       description: "CLI tool to configure Poe API for developer workflows.",
       license: "MIT",
       type: "module",