requestshield 2.0.0 → 2.1.0-qat.425

package/README.md

@@ -87,7 +87,8 @@ Status is a local check and does not contact RequestShield. JSON includes `state
 and `localOnly: true`, plus `expiresAt` and `scopes` when applicable. States are
 `signed_out`, `valid`, `expired`, `refresh_uncertain`, `config_mismatch`, `invalid`
 and `configuration_error`. Local `valid` status does not confirm online access.
-Logout removes your saved CLI session; your browser stays signed in.
+Logout removes your saved CLI session and revokes it at the auth service (best
+effort); your browser stays signed in.
 
 ## Applications and secrets
 

package/config/.env.qat

@@ -0,0 +1,7 @@
+# Public QAT settings for the QAT npm release and source runner. Never add secrets.
+API_URL=https://management-api-qat.intellifend.ai
+CHALLENGE_URL=https://challenge-dev.intellifend.ai
+DOCS_URL=https://docs-qat.intellifend.ai
+OAUTH_ISSUER=https://auth-qat.intellifend.ai
+OAUTH_CLIENT_ID=requestshield-cli
+OAUTH_RESOURCE=urn:theair:management-api:dev

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "requestshield",
-  "version": "2.0.0",
+  "version": "2.1.0-qat.425",
   "description": "Customer CLI for IntelliFend RequestShield.",
   "type": "module",
   "bin": {
@@ -9,11 +9,11 @@
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/",
-    "tag": "latest"
+    "tag": "qat"
   },
   "files": [
     "src/",
-    "config/.env.prod",
+    "config/.env.qat",
     "skills/",
     "README.md"
   ],
@@ -22,6 +22,6 @@
   },
   "license": "UNLICENSED",
   "requestshield": {
-    "profile": "prod"
+    "profile": "qat"
   }
 }

package/src/commands/signin.mjs

@@ -57,6 +57,7 @@ export async function signin(options, deps) {
       response_type: "code", redirect_uri: receiver.redirectUri,
       code_challenge: createHash("sha256").update(verifier).digest("base64url"),
       code_challenge_method: "S256", state, scope: REQUESTED_OAUTH_SCOPES.join(" "),
+      resource: deps.oauth.config.resource,
     }).toString();
     if (noOpen) {
       showAuthorizationUrl(authorizeUrl.href);

package/src/config.mjs

@@ -8,7 +8,7 @@ import { getPackageProfile } from "./package-profile.mjs";
 
 /** @typedef {'qat' | 'stg' | 'prod'} Profile */
 const PROFILES = new Set(["qat", "stg", "prod"]);
-const CONFIG_KEYS = new Set(["API_URL", "CHALLENGE_URL", "DOCS_URL", "OAUTH_ISSUER", "OAUTH_CLIENT_ID", "OAUTH_AUTHORIZATION_ISSUER"]);
+const CONFIG_KEYS = new Set(["API_URL", "CHALLENGE_URL", "DOCS_URL", "OAUTH_ISSUER", "OAUTH_CLIENT_ID", "OAUTH_AUTHORIZATION_ISSUER", "OAUTH_RESOURCE"]);
 
 export const DEFAULT_MAVEN_REPOSITORY =
     "https://sdk.intellifend.com/packages/maven";
@@ -24,17 +24,17 @@ export const REQUESTED_OAUTH_SCOPES = Object.freeze([
   "theair:secrets:write",
 ]);
 
-/** @typedef {{issuer: string, clientId: string, apiUrl: string}} OAuthConfig */
+/** @typedef {{issuer: string, clientId: string, apiUrl: string, resource: string}} OAuthConfig */
 
 /** Read only the selected package file; never load settings into process.env.
  * @param {Profile} [profile] @returns {OAuthConfig}
  */
 export function getOAuthConfig(profile = "prod") {
   const values = readProfileConfig(profile);
-  if (!values.OAUTH_ISSUER || !values.OAUTH_CLIENT_ID) {
+  if (!values.OAUTH_ISSUER || !values.OAUTH_CLIENT_ID || !values.OAUTH_RESOURCE) {
     throw invalidConfig("RequestShield sign-in is unavailable. Update the CLI and try again; if the problem continues, contact support.");
   }
-  return validateOAuthConfig({issuer: values.OAUTH_ISSUER, clientId: values.OAUTH_CLIENT_ID, apiUrl: configuredApiUrl(values, profile)});
+  return validateOAuthConfig({issuer: values.OAUTH_ISSUER, clientId: values.OAUTH_CLIENT_ID, apiUrl: configuredApiUrl(values, profile), resource: values.OAUTH_RESOURCE});
 }
 
 /** Callback-only issuer pin; it never selects discovery or token endpoints.
@@ -45,7 +45,7 @@ export function getAuthorizationIssuer(profile, fallbackIssuer) {
   return value ? validateAuthorizationIssuer(value) : fallbackIssuer;
 }
 
-/** Preserve exact provider identifiers, including non-URL Stytch project IDs.
+/** Preserve exact provider identifiers; the callback `iss` may be an opaque identifier.
  * @param {unknown} value @returns {string}
  */
 export function validateAuthorizationIssuer(value) {
@@ -58,13 +58,17 @@ export function validateAuthorizationIssuer(value) {
 /** Validate injected OAuth clients as well as file-based configuration.
  * @param {OAuthConfig} config @returns {OAuthConfig}
  */
-export function validateOAuthConfig({issuer: issuerValue, clientId, apiUrl}) {
+export function validateOAuthConfig({issuer: issuerValue, clientId, apiUrl, resource}) {
   const issuer = validatedUrl(issuerValue, "OAUTH_ISSUER");
   if (new URL(issuer).protocol !== "https:") throw invalidConfig("RequestShield sign-in is unavailable. Update the CLI and try again; if the problem continues, contact support.");
   if (typeof clientId !== "string" || !/^[A-Za-z0-9._~-]{1,256}$/.test(clientId)) {
     throw invalidConfig("RequestShield sign-in is unavailable. Update the CLI and try again; if the problem continues, contact support.");
   }
-  return {issuer, clientId, apiUrl: validatedUrl(apiUrl, "API_URL")};
+  // Management audience sent on authorize, code exchange and refresh so tokens are audience-bound JWTs.
+  if (typeof resource !== "string" || resource.length > 256 || !/^urn:[A-Za-z0-9][A-Za-z0-9-]{1,31}:[A-Za-z0-9()+,.:=@;$_!*'%/~-]+$/.test(resource)) {
+    throw invalidConfig("RequestShield sign-in is unavailable. Update the CLI and try again; if the problem continues, contact support.");
+  }
+  return {issuer, clientId, apiUrl: validatedUrl(apiUrl, "API_URL"), resource};
 }
 
 /** Shared API selection for signin binding and every authenticated command.

package/src/oauth-client.mjs

@@ -3,9 +3,10 @@ import { CliError } from "./errors.mjs";
 import { validateOAuthConfig, REQUESTED_OAUTH_SCOPES, validateBearerToken, validatedUrl } from "./config.mjs";
 
 /** @typedef {{accessToken: string, refreshToken: string, expiresAt: number, scopes: string[]}} OAuthCredentials */
-/** @typedef {{authorizationEndpoint: string, tokenEndpoint: string}} OAuthDiscovery */
+/** @typedef {{authorizationEndpoint: string, tokenEndpoint: string, revocationEndpoint?: string}} OAuthDiscovery */
 
 const MAX_BODY_BYTES = 64 * 1024;
+const REVOKE_TIMEOUT_MS = 5_000;
 
 export class OAuthClient {
   /** @param {{config: import('./config.mjs').OAuthConfig, fetchImpl?: typeof fetch, now?: () => number, timeoutMs?: number}} options */
@@ -33,7 +34,7 @@ export class OAuthClient {
     if (tokenUrl.protocol !== "https:" || tokenUrl.origin !== new URL(this.config.issuer).origin) throw invalidResponse();
     if (!Array.isArray(body.response_types_supported) || !body.response_types_supported.includes("code")
       || !Array.isArray(body.code_challenge_methods_supported) || !body.code_challenge_methods_supported.includes("S256")) throw invalidResponse();
-    this.discovery = {authorizationEndpoint, tokenEndpoint};
+    this.discovery = {authorizationEndpoint, tokenEndpoint, revocationEndpoint: sameOriginEndpoint(body.revocation_endpoint, this.config.issuer)};
     return this.discovery;
   }
 
@@ -42,7 +43,7 @@ export class OAuthClient {
     const {tokenEndpoint} = await this.discover({signal});
     const {body} = await this.#request(tokenEndpoint, {
       method: "POST",
-      body: new URLSearchParams({grant_type: "authorization_code", client_id: this.config.clientId, code, code_verifier: verifier, redirect_uri: redirectUri}),
+      body: new URLSearchParams({grant_type: "authorization_code", client_id: this.config.clientId, code, code_verifier: verifier, redirect_uri: redirectUri, resource: this.config.resource}),
     }, signal);
     return this.#credentials(body);
   }
@@ -53,7 +54,7 @@ export class OAuthClient {
     try {
       const {body} = await this.#request(tokenEndpoint, {
         method: "POST",
-        body: new URLSearchParams({grant_type: "refresh_token", client_id: this.config.clientId, refresh_token: refreshToken}),
+        body: new URLSearchParams({grant_type: "refresh_token", client_id: this.config.clientId, refresh_token: refreshToken, resource: this.config.resource}),
       });
       return this.#credentials(body);
     } catch (error) {
@@ -62,6 +63,29 @@ export class OAuthClient {
     }
   }
 
+  /** Best effort (RFC 7009): bounded, never throws, never echoes the response.
+   * @param {string} refreshToken @returns {Promise<boolean>} true when the provider accepted the request
+   */
+  async revoke(refreshToken) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), Math.min(this.timeoutMs, REVOKE_TIMEOUT_MS));
+    try {
+      const {revocationEndpoint} = await this.discover({signal: controller.signal});
+      if (!revocationEndpoint) return false;
+      const response = await Promise.race([
+        this.fetchImpl(revocationEndpoint, {
+          method: "POST", signal: controller.signal, redirect: "error", credentials: "omit", cache: "no-store",
+          headers: {"Content-Type": "application/x-www-form-urlencoded"},
+          body: new URLSearchParams({token: refreshToken, token_type_hint: "refresh_token", client_id: this.config.clientId}),
+        }),
+        new Promise((_, reject) => controller.signal.addEventListener("abort", reject, {once: true})),
+      ]);
+      void response.body?.cancel().catch(() => {});
+      return response.ok;
+    } catch { return false; }
+    finally { clearTimeout(timeout); controller.abort(); }
+  }
+
   /** @param {Record<string, unknown>} body @returns {OAuthCredentials} */
   #credentials(body) {
     let accessToken;
@@ -148,6 +172,18 @@ export class OAuthClient {
   }
 }
 
+/** Optional endpoints are used only when HTTPS on the issuer origin; otherwise ignored.
+ * @param {unknown} value @param {string} issuer @returns {string | undefined}
+ */
+function sameOriginEndpoint(value, issuer) {
+  if (value === undefined) return undefined;
+  try {
+    const endpoint = validatedUrl(value, "revocation endpoint");
+    const url = new URL(endpoint);
+    return url.protocol === "https:" && url.origin === new URL(issuer).origin ? endpoint : undefined;
+  } catch { return undefined; }
+}
+
 function invalidResponse() {
   return new CliError("Sign-in could not be completed. Try again; if the problem continues, contact support.", {code: "OAUTH_INVALID_RESPONSE", exitCode: 3});
 }

package/src/session-store.mjs

@@ -8,7 +8,7 @@ import { OAuthClient } from "./oauth-client.mjs";
 import { SessionFiles } from "./session-files.mjs";
 
 /** @typedef {{accessToken: string, refreshToken: string, expiresAt: number, scopes: string[]}} Credentials */
-/** @typedef {{issuer: string, clientId: string, apiUrl: string}} OAuthConfig */
+/** @typedef {import('./config.mjs').OAuthConfig} OAuthConfig */
 /** @typedef {Credentials & {version: 1, issuer: string, clientId: string, apiUrl: string, refreshState: "ready" | "in_progress"}} SavedSession */
 /** @typedef {'signed_out' | 'valid' | 'expired' | 'refresh_uncertain' | 'config_mismatch' | 'invalid' | 'configuration_error'} SessionState */
 /** @typedef {{profile: import('./config.mjs').Profile, apiUrl: string | null, issuer: string | null, clientId: string | null, state: SessionState, localOnly: true, expiresAt?: number, scopes?: string[]}} SessionStatus */
@@ -18,7 +18,7 @@ const REFRESH_WINDOW_MS = 60_000;
 export class SessionStore {
   /**
    * @param {{env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, homeDir?: string, profile?: import("./config.mjs").Profile,
-   * config?: OAuthConfig, oauth?: {refresh(token: string): Promise<Credentials>},
+   * config?: OAuthConfig, oauth?: {refresh(token: string): Promise<Credentials>, revoke?(token: string): Promise<boolean>},
    * now?: () => number, fs?: Partial<typeof import("node:fs/promises")>,
    * protectPath?: (file: string, directory: boolean) => Promise<void>, lockWaitMs?: number}} [options]
    */
@@ -78,9 +78,20 @@ export class SessionStore {
     };
   }
 
-  /** Remove only this profile's local credential; never revoke provider tokens. */
+  /** Remove only this profile's local credential, then revoke its refresh token
+   * best effort. Revocation is bounded and never fails logout. */
   async signout() {
-    return { profile: this.profile, removed: await this.files.remove() };
+    let refreshToken, config;
+    try {
+      config = this.#config();
+      const session = checkedSession(await this.files.read());
+      if (matchesConfig(session, config)) refreshToken = session.refreshToken;
+    } catch { /* Unreadable, mismatched or unconfigured sessions are still removed locally. */ }
+    const removed = await this.files.remove();
+    if (refreshToken && config) {
+      try { await (this.oauth ?? new OAuthClient({ config })).revoke?.(refreshToken); } catch { /* Best effort. */ }
+    }
+    return { profile: this.profile, removed };
   }
 
   async loadToken() {
@@ -127,7 +138,8 @@ export class SessionStore {
   #record(value) {
     const credentials = checkedCredentials(value);
     if (credentials.expiresAt <= this.now()) throw invalidSession();
-    return { version: 1, ...this.#config(), ...credentials, refreshState: "ready" };
+    const { issuer, clientId, apiUrl } = this.#config();
+    return { version: 1, issuer, clientId, apiUrl, ...credentials, refreshState: "ready" };
   }
 
   /** @returns {Promise<SavedSession>} */

package/config/.env.prod

@@ -1,9 +0,0 @@
-# Public production settings shipped in the npm package. Never add secrets.
-API_URL=https://management-api.intellifend.ai
-CHALLENGE_URL=https://challenge.intellifend.ai
-DOCS_URL=https://docs.intellifend.ai
-# Fill in the production Connected App values before releasing sign-in.
-OAUTH_ISSUER=https://diligent-snagglefoot-6840.customers.stytch.com
-# Optional callback iss pin; blank uses OAUTH_ISSUER.
-OAUTH_AUTHORIZATION_ISSUER=
-OAUTH_CLIENT_ID=connected-app-live-8383c2b5-6f1e-42b5-af4e-6c49e5bb5fe6