sitevision-cli 1.0.0-beta.5 → 1.0.0-beta.7

package/dist/utils/keychain.js

@@ -6,6 +6,15 @@ function deployAccount(domain, username) {
 function signingAccount(username) {
     return `signing:${username}`;
 }
+function oauthRefreshAccount(domain, clientId) {
+    return `oauth2-refresh:${clientId}@${domain}`;
+}
+function oauthSecretAccount(domain, clientId) {
+    return `oauth2-secret:${clientId}@${domain}`;
+}
+function sessionCookieAccount(domain, username) {
+    return `session:${username}@${domain}`;
+}
 function safeGet(account) {
     try {
         return new Entry(SERVICE, account).getPassword();
@@ -61,3 +70,48 @@ export function deleteSigningPassword(username) {
         return;
     safeDelete(signingAccount(username));
 }
+export function getOAuth2RefreshToken(domain, clientId) {
+    if (!domain || !clientId)
+        return null;
+    return safeGet(oauthRefreshAccount(domain, clientId));
+}
+export function setOAuth2RefreshToken(domain, clientId, token) {
+    if (!domain || !clientId || !token)
+        return false;
+    return safeSet(oauthRefreshAccount(domain, clientId), token);
+}
+export function deleteOAuth2RefreshToken(domain, clientId) {
+    if (!domain || !clientId)
+        return;
+    safeDelete(oauthRefreshAccount(domain, clientId));
+}
+export function getOAuth2ClientSecret(domain, clientId) {
+    if (!domain || !clientId)
+        return null;
+    return safeGet(oauthSecretAccount(domain, clientId));
+}
+export function setOAuth2ClientSecret(domain, clientId, secret) {
+    if (!domain || !clientId || !secret)
+        return false;
+    return safeSet(oauthSecretAccount(domain, clientId), secret);
+}
+export function deleteOAuth2ClientSecret(domain, clientId) {
+    if (!domain || !clientId)
+        return;
+    safeDelete(oauthSecretAccount(domain, clientId));
+}
+export function getSessionCookie(domain, username) {
+    if (!domain || !username)
+        return null;
+    return safeGet(sessionCookieAccount(domain, username));
+}
+export function setSessionCookie(domain, username, cookie) {
+    if (!domain || !username || !cookie)
+        return false;
+    return safeSet(sessionCookieAccount(domain, username), cookie);
+}
+export function deleteSessionCookie(domain, username) {
+    if (!domain || !username)
+        return;
+    safeDelete(sessionCookieAccount(domain, username));
+}

package/dist/utils/oauth2-auth.d.ts

@@ -0,0 +1,20 @@
+import type { DevProperties } from '../types/index.js';
+/** Default loopback port. Fixed so a single redirect URI can be whitelisted. */
+export declare const DEFAULT_REDIRECT_PORT = 8137;
+/** RFC 7636 S256 pair. Exported for testing the challenge derivation. */
+export declare function createPkcePair(): {
+    verifier: string;
+    challenge: string;
+};
+/**
+ * Return a usable OAuth2 access token, or null if one can't be obtained.
+ *
+ * Order: silent refresh from the keychain refresh token, then (when
+ * `interactive`) a browser login. The access token is never persisted; the
+ * refresh token is stored in the keychain for next time. Pass
+ * `interactive: false` from contexts that can't own the terminal (the Ink
+ * menu) to get refresh-only resolution with no browser.
+ */
+export declare function resolveOAuth2AccessToken(dev: DevProperties, options?: {
+    interactive?: boolean;
+}): Promise<string | null>;

package/dist/utils/oauth2-auth.js

@@ -0,0 +1,160 @@
+import http from 'http';
+import crypto from 'crypto';
+import { spawn } from 'child_process';
+import { makeRequest } from './sitevision-api.js';
+import { getOAuth2RefreshToken, setOAuth2RefreshToken, deleteOAuth2RefreshToken, getOAuth2ClientSecret, } from './keychain.js';
+/** Default loopback port. Fixed so a single redirect URI can be whitelisted. */
+export const DEFAULT_REDIRECT_PORT = 8137;
+/** Seconds to wait for the user to finish logging in before giving up. */
+const LOGIN_TIMEOUT_MS = 300_000;
+function base64url(buffer) {
+    return buffer
+        .toString('base64')
+        .replaceAll('+', '-')
+        .replaceAll('/', '_')
+        .replaceAll('=', '');
+}
+/** RFC 7636 S256 pair. Exported for testing the challenge derivation. */
+export function createPkcePair() {
+    const verifier = base64url(crypto.randomBytes(32));
+    const challenge = base64url(crypto.createHash('sha256').update(verifier).digest());
+    return { verifier, challenge };
+}
+function hasOAuth2Config(config) {
+    return Boolean(config?.authorizationEndpoint && config.tokenEndpoint && config.clientId);
+}
+async function postToken(config, params, secret) {
+    const body = Buffer.from(new URLSearchParams(params).toString());
+    try {
+        const response = await makeRequest(config.tokenEndpoint, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                'Content-Length': String(body.length),
+            },
+            body,
+            // client_secret_basic when confidential; public+PKCE clients omit it.
+            auth: secret ? { username: config.clientId, password: secret } : undefined,
+        });
+        if (response.statusCode !== 200)
+            return null;
+        return JSON.parse(response.body.toString());
+    }
+    catch {
+        return null;
+    }
+}
+function openBrowser(url) {
+    const isWin = process.platform === 'win32';
+    const cmd = process.platform === 'darwin' ? 'open' : isWin ? 'cmd' : 'xdg-open';
+    const args = isWin ? ['/c', 'start', '', url] : [url];
+    try {
+        spawn(cmd, args, { stdio: 'ignore', detached: true }).unref();
+    }
+    catch {
+        // Fall back to the printed URL.
+    }
+}
+/** Serve the loopback redirect once, resolving the authorization code. */
+function waitForCode(port, state) {
+    return new Promise(resolve => {
+        let settled = false;
+        const finish = (code) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            server.close();
+            resolve(code);
+        };
+        const server = http.createServer((req, res) => {
+            const url = new URL(req.url ?? '/', `http://127.0.0.1:${port}`);
+            if (url.pathname !== '/callback') {
+                res.writeHead(404).end();
+                return;
+            }
+            const ok = url.searchParams.get('state') === state;
+            const code = url.searchParams.get('code');
+            const message = ok && code
+                ? 'Login complete. You can close this window and return to the terminal.'
+                : 'Login failed. Check the terminal.';
+            res.writeHead(200, { 'Content-Type': 'text/html' });
+            res.end(`<!doctype html><meta charset="utf-8"><p>${message}</p>`);
+            finish(ok ? code : null);
+        });
+        const timer = setTimeout(() => finish(null), LOGIN_TIMEOUT_MS);
+        server.on('error', () => finish(null));
+        server.listen(port, '127.0.0.1');
+    });
+}
+async function interactiveLogin(config, secret) {
+    const port = config.redirectPort ?? DEFAULT_REDIRECT_PORT;
+    const redirectUri = `http://127.0.0.1:${port}/callback`;
+    const { verifier, challenge } = createPkcePair();
+    const state = base64url(crypto.randomBytes(16));
+    const authUrl = new URL(config.authorizationEndpoint);
+    authUrl.searchParams.set('response_type', 'code');
+    authUrl.searchParams.set('client_id', config.clientId);
+    authUrl.searchParams.set('redirect_uri', redirectUri);
+    authUrl.searchParams.set('state', state);
+    authUrl.searchParams.set('code_challenge', challenge);
+    authUrl.searchParams.set('code_challenge_method', 'S256');
+    if (config.scopes?.length) {
+        authUrl.searchParams.set('scope', config.scopes.join(' '));
+    }
+    const codePromise = waitForCode(port, state);
+    openBrowser(authUrl.href);
+    console.log(`\nOpening browser to log in. If it doesn't open, visit:\n${authUrl.href}\n`);
+    const code = await codePromise;
+    if (!code)
+        return null;
+    return postToken(config, {
+        grant_type: 'authorization_code',
+        code,
+        redirect_uri: redirectUri,
+        client_id: config.clientId,
+        code_verifier: verifier,
+    }, secret);
+}
+/**
+ * Return a usable OAuth2 access token, or null if one can't be obtained.
+ *
+ * Order: silent refresh from the keychain refresh token, then (when
+ * `interactive`) a browser login. The access token is never persisted; the
+ * refresh token is stored in the keychain for next time. Pass
+ * `interactive: false` from contexts that can't own the terminal (the Ink
+ * menu) to get refresh-only resolution with no browser.
+ */
+export async function resolveOAuth2AccessToken(dev, options = {}) {
+    const { interactive = true } = options;
+    const config = dev.oauth2;
+    if (!hasOAuth2Config(config))
+        return null;
+    const { domain } = dev;
+    const secret = getOAuth2ClientSecret(domain, config.clientId) ?? undefined;
+    const storedRefresh = getOAuth2RefreshToken(domain, config.clientId);
+    if (storedRefresh) {
+        const tokens = await postToken(config, {
+            grant_type: 'refresh_token',
+            refresh_token: storedRefresh,
+            client_id: config.clientId,
+        }, secret);
+        if (tokens?.access_token) {
+            if (tokens.refresh_token) {
+                setOAuth2RefreshToken(domain, config.clientId, tokens.refresh_token);
+            }
+            return tokens.access_token;
+        }
+        // Stale/expired refresh token — drop it and log in fresh.
+        deleteOAuth2RefreshToken(domain, config.clientId);
+    }
+    if (!interactive || !process.stdin.isTTY)
+        return null;
+    const tokens = await interactiveLogin(config, secret);
+    if (!tokens?.access_token)
+        return null;
+    if (tokens.refresh_token) {
+        setOAuth2RefreshToken(domain, config.clientId, tokens.refresh_token);
+    }
+    return tokens.access_token;
+}

package/dist/utils/password-prompt.d.ts

@@ -3,6 +3,11 @@
  * Pressing Enter (empty answer) returns `defaultYes` (default: false).
  */
 export declare function promptYesNo(prompt: string, defaultYes?: boolean): Promise<boolean>;
+/**
+ * Wait for the user to press Enter (or Ctrl+C). Used to hand control to an
+ * external browser and resume once the user says they're done.
+ */
+export declare function promptEnter(prompt: string): Promise<void>;
 /**
  * Prompt for password input with masked display
  */

package/dist/utils/password-prompt.js

@@ -29,6 +29,34 @@ export function promptYesNo(prompt, defaultYes = false) {
         stdin.on('data', onData);
     });
 }
+/**
+ * Wait for the user to press Enter (or Ctrl+C). Used to hand control to an
+ * external browser and resume once the user says they're done.
+ */
+export function promptEnter(prompt) {
+    return new Promise(resolve => {
+        process.stdout.write(prompt);
+        const stdin = process.stdin;
+        stdin.setRawMode(true);
+        stdin.resume();
+        stdin.setEncoding('utf8');
+        const onData = (data) => {
+            const char = data[0] || '';
+            const charCode = char.charCodeAt(0);
+            if (charCode === 3) {
+                process.exit();
+            }
+            if (char === '' || charCode === 13 || charCode === 10) {
+                stdin.setRawMode(false);
+                stdin.removeListener('data', onData);
+                stdin.pause();
+                process.stdout.write('\n');
+                resolve();
+            }
+        };
+        stdin.on('data', onData);
+    });
+}
 /**
  * Prompt for password input with masked display
  */

package/dist/utils/project-detection.d.ts

@@ -98,8 +98,9 @@ export declare function isBundledApp(manifest: SitevisionManifest): boolean;
  */
 export declare function readDevProperties(projectRoot: string): DevProperties | null;
 /**
- * Write dev properties to file. The `password` field is never persisted —
- * it is held in the OS keychain instead.
+ * Write dev properties to file. Secrets are never persisted — `password`,
+ * `accessToken` and `sessionCookie` are held in the OS keychain / resolved at
+ * runtime instead.
  */
 export declare function writeDevProperties(projectRoot: string, properties: DevProperties): void;
 /**

package/dist/utils/project-detection.js

@@ -1,6 +1,6 @@
 import fs from 'fs';
 import path from 'path';
-import { getDeployPassword, setDeployPassword } from './keychain.js';
+import { getDeployPassword, setDeployPassword, getSessionCookie, } from './keychain.js';
 import { parseJsonc } from './jsonc.js';
 // =============================================================================
 // LOCALIZED TEXT
@@ -244,6 +244,25 @@ export function detectProject(cwd = process.cwd()) {
                         }
                     }
                 }
+                // Resolve an OAuth2 access token: env var > keychain refresh.
+                // The env var is the manual/CI path; the interactive login stores a
+                // refresh token in the keychain and mints access tokens from it.
+                if (devProperties.authMethod === 'oauth2') {
+                    const envToken = process.env['SITEVISION_ACCESS_TOKEN'];
+                    if (envToken) {
+                        devProperties.accessToken = envToken;
+                    }
+                }
+                // Resolve a session cookie: env var > keychain (captured at login).
+                if (devProperties.authMethod === 'cookie' &&
+                    devProperties.domain &&
+                    devProperties.username) {
+                    const envCookie = process.env['SITEVISION_SESSION_COOKIE'];
+                    devProperties.sessionCookie =
+                        envCookie ??
+                            getSessionCookie(devProperties.domain, devProperties.username) ??
+                            undefined;
+                }
             }
             catch {
                 // Invalid dev properties file
@@ -323,13 +342,14 @@ export function readDevProperties(projectRoot) {
     }
 }
 /**
- * Write dev properties to file. The `password` field is never persisted —
- * it is held in the OS keychain instead.
+ * Write dev properties to file. Secrets are never persisted — `password`,
+ * `accessToken` and `sessionCookie` are held in the OS keychain / resolved at
+ * runtime instead.
  */
 export function writeDevProperties(projectRoot, properties) {
     const devPropertiesPath = findDevPropertiesPath(projectRoot) ||
         getDefaultDevPropertiesPath(projectRoot);
-    const { password: _password, ...persisted } = properties;
+    const { password: _password, accessToken: _accessToken, sessionCookie: _sessionCookie, ...persisted } = properties;
     fs.writeFileSync(devPropertiesPath, JSON.stringify(persisted, null, 2));
 }
 export function readSvcConfig(projectRoot) {

package/dist/utils/session-cookie-auth.d.ts

@@ -0,0 +1,9 @@
+import type { DevProperties } from '../types/index.js';
+/**
+ * Return a usable session cookie, or null. Order: keychain (a prior capture),
+ * then (when `interactive`) a browser login. Pass `interactive: false` from the
+ * Ink menu, which can't own the terminal for the "press Enter" handoff.
+ */
+export declare function resolveSessionCookie(dev: DevProperties, options?: {
+    interactive?: boolean;
+}): Promise<string | null>;

package/dist/utils/session-cookie-auth.js

@@ -0,0 +1,96 @@
+import { getSessionCookie, setSessionCookie } from './keychain.js';
+import { promptEnter } from './password-prompt.js';
+function bareDomain(domain) {
+    return domain.replace(/^\./, '');
+}
+/** Related if either host is the other or a subdomain of it (both directions). */
+function domainRelated(a, b) {
+    const x = bareDomain(a);
+    const y = bareDomain(b);
+    return x === y || x.endsWith(`.${y}`) || y.endsWith(`.${x}`);
+}
+/** Read every cookie in the browser jar (httponly and secure included). */
+async function readAllCookies(browser, page) {
+    // puppeteer >= 22 exposes the whole jar directly.
+    if (typeof browser.cookies === 'function') {
+        try {
+            return (await browser.cookies());
+        }
+        catch {
+            // Fall through to CDP.
+        }
+    }
+    const client = await page.createCDPSession();
+    const { cookies } = await client.send('Network.getAllCookies');
+    return cookies;
+}
+/**
+ * Open a real browser at the login URL, let the user complete SSO, then read
+ * the session cookies via CDP — which returns httponly, secure cookies that
+ * page JavaScript can't see. Returns a `Cookie:` header value, or null.
+ */
+async function captureViaBrowser(loginUrl, siteDomain) {
+    let puppeteer;
+    try {
+        ({ default: puppeteer } = await import('puppeteer-core'));
+    }
+    catch {
+        console.log('\x1b[31mpuppeteer-core is not installed. Run `npm i puppeteer-core`, or pass --cookie / set SITEVISION_SESSION_COOKIE.\x1b[0m');
+        return null;
+    }
+    let browser;
+    try {
+        browser = await puppeteer.launch({ headless: false, channel: 'chrome' });
+        const page = await browser.newPage();
+        await page.goto(loginUrl, { waitUntil: 'domcontentloaded' }).catch(() => {
+            // A SAML redirect may abort the initial navigation — that's fine.
+        });
+        await promptEnter('\nLog in in the browser this tool opened, then press Enter here to capture the session: ');
+        const all = await readAllCookies(browser, page);
+        const sessions = all.filter(c => c.name === 'JSESSIONID');
+        if (sessions.length === 0) {
+            const domains = [...new Set(all.map(c => bareDomain(c.domain)))];
+            console.log(`\x1b[31mNo JSESSIONID among ${all.length} cookies.\x1b[0m`);
+            console.log(`Cookie domains seen: ${domains.join(', ') || '(none — was the login done in the browser this tool opened?)'}`);
+            console.log('If those are only your IdP and not the Sitevision site, open a Sitevision page/editor in that same browser (so it issues a session), then run this again.');
+            return null;
+        }
+        // Prefer the JSESSIONID on the deploy host; else take the only/first one.
+        const chosen = sessions.find(c => domainRelated(c.domain, siteDomain)) ?? sessions[0];
+        const cookies = all.filter(c => domainRelated(c.domain, chosen.domain));
+        console.log(`\x1b[32mCaptured session on ${bareDomain(chosen.domain)} (${cookies.length} cookies).\x1b[0m`);
+        return cookies.map(c => `${c.name}=${c.value}`).join('; ');
+    }
+    catch (error) {
+        console.log(`\x1b[31mBrowser login failed: ${error instanceof Error ? error.message : String(error)}\x1b[0m`);
+        return null;
+    }
+    finally {
+        if (browser) {
+            await browser.close().catch(() => {
+                // Best-effort close.
+            });
+        }
+    }
+}
+/**
+ * Return a usable session cookie, or null. Order: keychain (a prior capture),
+ * then (when `interactive`) a browser login. Pass `interactive: false` from the
+ * Ink menu, which can't own the terminal for the "press Enter" handoff.
+ */
+export async function resolveSessionCookie(dev, options = {}) {
+    const { interactive = true } = options;
+    const { domain, username } = dev;
+    if (!domain || !username)
+        return null;
+    const stored = getSessionCookie(domain, username);
+    if (stored)
+        return stored;
+    if (!interactive || !process.stdin.isTTY)
+        return null;
+    const loginUrl = dev.sessionLoginUrl || `https://${domain}/`;
+    const cookie = await captureViaBrowser(loginUrl, domain);
+    if (cookie)
+        setSessionCookie(domain, username, cookie);
+    return cookie;
+}

package/dist/utils/sitevision-api.d.ts

@@ -13,6 +13,27 @@ import type { SigningCredentials, DeployConfig, ProductionDeployConfig, SigningR
  * Create Basic Auth header value
  */
 declare function createBasicAuth(username: string, password: string): string;
+type RequestAuth = {
+    username: string;
+    password: string;
+} | {
+    token: string;
+} | {
+    cookie: string;
+};
+type AuthKind = 'basic' | 'bearer' | 'cookie';
+/** Single source of the 401 message, worded for the auth kind actually used. */
+declare function unauthorizedMessage(kind: AuthKind): string;
+/** Pick cookie > bearer > basic based on what the deploy config carries. */
+declare function configAuth(config: {
+    username: string;
+    password?: string;
+    accessToken?: string;
+    sessionCookie?: string;
+}): {
+    auth: RequestAuth;
+    kind: AuthKind;
+};
 /**
  * Make an HTTP/HTTPS request
  */
@@ -20,10 +41,7 @@ export declare function makeRequest(url: string, options: {
     method: string;
     headers?: Record<string, string>;
     body?: Buffer;
-    auth?: {
-        username: string;
-        password: string;
-    };
+    auth?: RequestAuth;
     timeoutMs?: number;
 }): Promise<{
     statusCode: number;
@@ -45,6 +63,12 @@ export declare function summarizeErrorBody(body: Buffer, headers: Record<string,
  * the signing endpoint returns an error page with HTTP 200.
  */
 export declare function looksLikeZip(body: Buffer): boolean;
+/**
+ * A stale Sitevision session usually answers with a redirect to the login page
+ * or a 200 carrying an HTML login form — not a clean 401. Detect both so cookie
+ * auth can drop the dead session and re-login instead of showing a generic error.
+ */
+export declare function looksLikeAuthExpired(statusCode: number, body: Buffer, headers: Record<string, string>): boolean;
 /**
  * Sign an app via developer.sitevision.se
  *
@@ -85,4 +109,4 @@ export declare function createAddon(config: DeployConfig, appType: SimpleAppType
  * @param appType - The app type (web, widget, rest)
  */
 export declare function activateApp(executableId: string, config: DeployConfig, _appType: SimpleAppType): Promise<ActivationResponse>;
-export { createBasicAuth };
+export { createBasicAuth, configAuth, unauthorizedMessage };