securewithtrace 0.18.0 → 0.18.1

package/dist/index.js

@@ -26548,6 +26548,101 @@ function collectFilterExpression(value, previous) {
   previous.push(value);
   return previous;
 }
+function extractErrorMessage(body) {
+  if (typeof body === "object" && body !== null && "message" in body && typeof body.message === "string") {
+    const message = body.message.trim();
+    return message.length > 0 ? message : null;
+  }
+  return null;
+}
+function decodeJwtExpiration(token) {
+  if (!token) {
+    return null;
+  }
+  const parts = token.split(".");
+  const payload = parts[1];
+  if (!payload) {
+    return null;
+  }
+  try {
+    const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf-8"));
+    if (typeof decoded.exp !== "number" || !Number.isFinite(decoded.exp)) {
+      return null;
+    }
+    return new Date(decoded.exp * 1e3);
+  } catch {
+    return null;
+  }
+}
+function resolveLocalCloneAuthFailure() {
+  const token = readTokenSafe();
+  if (!token) {
+    return { kind: "not_logged_in", hasRefreshToken: readRefreshToken() !== null };
+  }
+  const expiresAt = decodeJwtExpiration(token);
+  if (expiresAt && expiresAt.getTime() <= Date.now()) {
+    return { kind: "expired_access_token", hasRefreshToken: readRefreshToken() !== null };
+  }
+  return { kind: "organization_unresolved" };
+}
+function buildCloneTokenFailureWarning(cloneUrl, failure) {
+  const fallbackSuffix = "Falling back to standard git authentication for this clone attempt.";
+  const quotedMessage = failure.message ? ` (${failure.message})` : "";
+  switch (failure.kind) {
+    case "not_logged_in":
+      return `Trace clone credentials are unavailable for ${cloneUrl}: you are not logged in. Run \`tracecli auth login\`. ${fallbackSuffix}`;
+    case "expired_access_token":
+      return `Trace clone credentials are unavailable for ${cloneUrl}: your CLI access token is expired${failure.hasRefreshToken ? ", and refresh did not complete" : ""}. Run \`tracecli auth logout && tracecli auth login\`, then retry. ${fallbackSuffix}`;
+    case "organization_unresolved":
+      return `Trace clone credentials are unavailable for ${cloneUrl}: the active organization could not be resolved from your session. Run \`tracecli org current\` and \`tracecli org switch <organization>\`, or re-authenticate with \`tracecli auth logout && tracecli auth login\`. ${fallbackSuffix}`;
+    case "request_failed":
+      return `Trace clone credentials are temporarily unavailable for ${cloneUrl}: the request to the Trace API failed. Check connectivity, then retry. ${fallbackSuffix}`;
+    case "unauthorized":
+      return `Trace rejected clone credential generation for ${cloneUrl} (401${quotedMessage}). Re-authenticate with \`tracecli auth logout && tracecli auth login\`, then retry. ${fallbackSuffix}`;
+    case "forbidden":
+      return `Trace denied clone credential generation for ${cloneUrl} (403${quotedMessage}). Confirm you can access this organization and repository in Trace. ${fallbackSuffix}`;
+    case "not_found":
+      return `Trace could not generate clone credentials for ${cloneUrl} (404${quotedMessage}). Ensure the repository is connected in the active organization and the GitHub App installation is active. ${fallbackSuffix}`;
+    case "server_error":
+      return `Trace failed to generate clone credentials for ${cloneUrl} due to a server error${quotedMessage}. Retry shortly. ${fallbackSuffix}`;
+    case "unexpected_status":
+      return `Trace returned an unexpected response while generating clone credentials for ${cloneUrl}${quotedMessage ? ` ${quotedMessage}` : ""}. ${fallbackSuffix}`;
+  }
+}
+function withOptionalMessage(base, message) {
+  if (typeof message === "string") {
+    return { ...base, message };
+  }
+  return base;
+}
+async function listOrganizationsSafe() {
+  const result = await authenticatedRequestSafe(
+    (client) => client.organization.listMyOrganizations()
+  );
+  if (!result || result.status !== 200) {
+    return null;
+  }
+  return result.body;
+}
+function resolveWorkosOrganizationId(organizations, organizationId) {
+  const organization = organizations.find((item) => item.organizationId === organizationId);
+  const workosOrganizationId = organization?.workosOrganizationId;
+  if (!workosOrganizationId || workosOrganizationId.trim().length === 0) {
+    return null;
+  }
+  return workosOrganizationId;
+}
+async function maybeRefreshCloneTokenSessionForOrganization(organizationId, listOrganizations = listOrganizationsSafe, refreshForOrganization = (workosOrganizationId) => refreshStoredAccessTokenForOrganization(workosOrganizationId)) {
+  const organizations = await listOrganizations();
+  if (!organizations) {
+    return false;
+  }
+  const workosOrganizationId = resolveWorkosOrganizationId(organizations, organizationId);
+  if (!workosOrganizationId) {
+    return false;
+  }
+  return refreshForOrganization(workosOrganizationId);
+}
 function toRepositoryListFilterOptions(options) {
   return {
     ...options.platform ? { platform: options.platform } : {},
@@ -26764,24 +26859,66 @@ async function fetchCloneToken(repoUrl) {
   try {
     const organizationId = await resolveOrganizationIdSafe();
     if (!organizationId) {
-      return null;
+      return { token: null, failure: resolveLocalCloneAuthFailure() };
     }
-    const result = await authenticatedRequestSafe(
+    let result = await authenticatedRequestSafe(
       (client) => client.repository.getCloneToken({
         params: { organizationId },
         body: { repositoryUrl: repoUrl }
       })
     );
+    if (result && (result.status === 401 || result.status === 403)) {
+      const refreshed = await maybeRefreshCloneTokenSessionForOrganization(organizationId);
+      if (refreshed) {
+        result = await authenticatedRequestSafe(
+          (client) => client.repository.getCloneToken({
+            params: { organizationId },
+            body: { repositoryUrl: repoUrl }
+          })
+        );
+      }
+    }
     if (!result) {
-      return null;
+      return { token: null, failure: { kind: "request_failed" } };
     }
     if (result.status === 200) {
       const token = result.body.token.trim();
-      return token.length > 0 ? token : null;
+      if (token.length > 0) {
+        return { token, failure: null };
+      }
+      return { token: null, failure: { kind: "unexpected_status", status: 200 } };
     }
-    return null;
+    const message = extractErrorMessage(result.body) ?? void 0;
+    if (result.status === 401) {
+      return {
+        token: null,
+        failure: withOptionalMessage({ kind: "unauthorized", status: 401 }, message)
+      };
+    }
+    if (result.status === 403) {
+      return {
+        token: null,
+        failure: withOptionalMessage({ kind: "forbidden", status: 403 }, message)
+      };
+    }
+    if (result.status === 404) {
+      return {
+        token: null,
+        failure: withOptionalMessage({ kind: "not_found", status: 404 }, message)
+      };
+    }
+    if (result.status >= 500) {
+      return {
+        token: null,
+        failure: withOptionalMessage({ kind: "server_error", status: result.status }, message)
+      };
+    }
+    return {
+      token: null,
+      failure: withOptionalMessage({ kind: "unexpected_status", status: result.status }, message)
+    };
   } catch {
-    return null;
+    return { token: null, failure: { kind: "request_failed" } };
   }
 }
 function createCloneCommand() {
@@ -26797,8 +26934,14 @@ Examples:
       const cloneUrl = resolveRepoUrl(repository);
       const targetDir = directory ?? extractRepoName(repository);
       let installationToken = null;
+      let cloneTokenFailure = null;
       if (cloneUrl.startsWith("https://github.com/")) {
-        installationToken = await fetchCloneToken(cloneUrl);
+        const cloneTokenResult = await fetchCloneToken(cloneUrl);
+        installationToken = cloneTokenResult.token;
+        cloneTokenFailure = cloneTokenResult.failure;
+        if (cloneTokenFailure) {
+          console.warn(buildCloneTokenFailureWarning(cloneUrl, cloneTokenFailure));
+        }
       }
       const effectiveUrl = installationToken ? urlWithUsername(cloneUrl) : cloneUrl;
       let askPassScript;
@@ -26827,6 +26970,11 @@ Examples:
         });
         const exitCode = await proc.exited;
         if (exitCode !== 0) {
+          if (!installationToken && cloneTokenFailure) {
+            console.error(
+              "Clone failed while Trace clone credentials were unavailable. Resolve the warning above and retry."
+            );
+          }
           process.exit(1);
         }
         if (installationToken) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securewithtrace",
-  "version": "0.18.0",
+  "version": "0.18.1",
   "description": "Official Trace CLI for vulnerability intelligence in your terminal",
   "type": "module",
   "bin": {