sliccy 6.154.1 → 6.154.2

package/dist/node-server/routes/secrets.js

@@ -8,7 +8,7 @@ import { handleDaSignAndForward, handleS3SignAndForward } from '../secrets/sign-
  * the 500 they got with the server log; the detail goes to the file logger
  * (above DEBUG) only when devMode is on.
  */
-function respondSignAndForwardError(res, err, devMode, label) {
+export function respondSignAndForwardError(res, err, devMode, label) {
     const traceId = (globalThis.crypto?.randomUUID?.() ?? Math.random().toString(36).slice(2, 10)).slice(0, 8);
     console.error(`${label} sign-and-forward error [trace=${traceId}]`);
     if (devMode) {
@@ -29,7 +29,7 @@ function isStringArray(value) {
  * Scope edit handler — updates allowed domains of an existing secret without
  * changing its value. Checks session store first, then falls back to persisted.
  */
-async function handleScopeEdit(res, name, domains, secretStore, secretProxy) {
+export async function handleScopeEdit(res, name, domains, secretStore, secretProxy) {
     if (typeof name !== 'string' || !isStringArray(domains)) {
         return res.status(400).json({ error: 'bad-request' });
     }
@@ -81,7 +81,7 @@ function handleRedactExport(res, texts, secretProxy) {
  * session shadow does not leak through after deletion, then falls back to the
  * persisted store. Reloads the masking pipeline either way.
  */
-async function handleDeleteSecret(name, res, secretStore, secretProxy) {
+export async function handleDeleteSecret(name, res, secretStore, secretProxy) {
     if (typeof name !== 'string' || name.length === 0) {
         return res.status(400).json({ error: 'bad-request' });
     }
@@ -104,6 +104,31 @@ async function handleDeleteSecret(name, res, secretStore, secretProxy) {
             .json({ error: err instanceof Error ? err.message : 'Failed to delete secret' });
     }
 }
+function registerOauthSecretRoutes(app, oauthStore, secretProxy) {
+    app.post('/api/secrets/oauth-update', express.json(), async (req, res) => {
+        const { providerId, accessToken, domains } = req.body ?? {};
+        if (typeof providerId !== 'string' ||
+            typeof accessToken !== 'string' ||
+            !isStringArray(domains) ||
+            domains.length === 0) {
+            return res.status(400).json({ error: 'bad-request' });
+        }
+        const name = `oauth.${providerId}.token`;
+        oauthStore.set(name, accessToken, domains);
+        await secretProxy.reload();
+        const masked = secretProxy.getMaskedEntries().find((e) => e.name === name)?.maskedValue;
+        res.json({ providerId, name, maskedValue: masked, domains });
+    });
+    app.delete('/api/secrets/oauth/:providerId', async (req, res) => {
+        const name = `oauth.${req.params.providerId}.token`;
+        if (!oauthStore.list().some((e) => e.name === name)) {
+            return res.status(404).json({ error: 'not-found' });
+        }
+        oauthStore.delete(name);
+        await secretProxy.reload();
+        res.status(204).end();
+    });
+}
 /**
  * Secret management API — direct .env file access (no browser needed). The
  * `secretStore` is wired into `secretProxy` so the fetch-proxy and the
@@ -111,6 +136,8 @@ async function handleDeleteSecret(name, res, secretStore, secretProxy) {
  */
 export function registerSecretRoutes(app, deps) {
     const { secretStore, secretProxy, oauthStore, devMode } = deps;
+    const handleS3 = deps.handleS3 ?? handleS3SignAndForward;
+    const handleDa = deps.handleDa ?? handleDaSignAndForward;
     app.get('/api/secrets', (_req, res) => {
         try {
             res.json(secretStore.list());
@@ -197,7 +224,7 @@ export function registerSecretRoutes(app, deps) {
     // never sees access_key_id / secret_access_key.
     app.post('/api/s3-sign-and-forward', async (req, res) => {
         try {
-            await handleS3SignAndForward(req, res, secretStore);
+            await handleS3(req, res, secretStore);
         }
         catch (err) {
             respondSignAndForwardError(res, err, devMode, 'S3');
@@ -209,7 +236,7 @@ export function registerSecretRoutes(app, deps) {
     // to remove the browser exposure entirely.
     app.post('/api/da-sign-and-forward', async (req, res) => {
         try {
-            await handleDaSignAndForward(req, res);
+            await handleDa(req, res);
         }
         catch (err) {
             respondSignAndForwardError(res, err, devMode, 'DA');
@@ -252,29 +279,6 @@ export function registerSecretRoutes(app, deps) {
                 .json({ error: err instanceof Error ? err.message : 'Failed to get masked secrets' });
         }
     });
-    // OAuth secret update — stores access token from OAuth login flow
-    app.post('/api/secrets/oauth-update', express.json(), async (req, res) => {
-        const { providerId, accessToken, domains } = req.body ?? {};
-        if (typeof providerId !== 'string' ||
-            typeof accessToken !== 'string' ||
-            !isStringArray(domains) ||
-            domains.length === 0) {
-            return res.status(400).json({ error: 'bad-request' });
-        }
-        const name = `oauth.${providerId}.token`;
-        oauthStore.set(name, accessToken, domains);
-        await secretProxy.reload();
-        const masked = secretProxy.getMaskedEntries().find((e) => e.name === name)?.maskedValue;
-        res.json({ providerId, name, maskedValue: masked, domains });
-    });
-    // OAuth secret deletion — removes access token on logout
-    app.delete('/api/secrets/oauth/:providerId', async (req, res) => {
-        const name = `oauth.${req.params.providerId}.token`;
-        if (!oauthStore.list().some((e) => e.name === name)) {
-            return res.status(404).json({ error: 'not-found' });
-        }
-        oauthStore.delete(name);
-        await secretProxy.reload();
-        res.status(204).end();
-    });
+    // OAuth update/deletion — stores access tokens after login and removes them on logout.
+    registerOauthSecretRoutes(app, oauthStore, secretProxy);
 }

package/dist/node-server/secrets/proxy-manager.d.ts

@@ -7,9 +7,10 @@
  *
  * As of Task 1.4, this is a thin wrapper around SecretsPipeline from @slicc/shared-ts.
  */
-import { SecretsPipeline, SessionSecretStore } from '../_shared/index.js';
+import { type FetchProxySecretSource, SecretsPipeline, SessionSecretStore } from '../_shared/index.js';
 import type { EnvSecretStore } from './env-secret-store.js';
 import type { OauthSecretStore } from './oauth-secret-store.js';
+export declare function buildFetchProxySecretSource(getEnvStore: () => EnvSecretStore | undefined, getOauthStore: () => OauthSecretStore | undefined): FetchProxySecretSource;
 export declare class SecretProxyManager {
     private readonly pipeline;
     private readonly _sessionId;

package/dist/node-server/secrets/proxy-manager.js

@@ -9,6 +9,32 @@
  */
 import { randomUUID } from 'node:crypto';
 import { SecretsPipeline, SessionSecretStore } from '../_shared/index.js';
+export function buildFetchProxySecretSource(getEnvStore, getOauthStore) {
+    return {
+        get: async (name) => {
+            const fromOauth = getOauthStore()?.get(name);
+            if (fromOauth !== undefined)
+                return fromOauth;
+            return getEnvStore()?.get(name)?.value ?? undefined;
+        },
+        listAll: async () => {
+            const list = [];
+            // OAuth wins on name collision (reserved namespace policy)
+            const oauthList = getOauthStore()?.list() ?? [];
+            const oauthNames = new Set(oauthList.map((e) => e.name));
+            for (const e of oauthList)
+                list.push({ name: e.name, value: e.value, domains: e.domains });
+            const envEntries = getEnvStore()?.list() ?? [];
+            for (const entry of envEntries) {
+                const secret = getEnvStore()?.get(entry.name);
+                if (!secret || oauthNames.has(entry.name))
+                    continue;
+                list.push({ name: secret.name, value: secret.value, domains: secret.domains });
+            }
+            return list;
+        },
+    };
+}
 export class SecretProxyManager {
     pipeline;
     _sessionId;
@@ -28,32 +54,7 @@ export class SecretProxyManager {
         });
     }
     buildSource() {
-        const env = () => this._envStore;
-        const oauth = () => this._oauthStore;
-        return {
-            get: async (name) => {
-                const fromOauth = oauth()?.get(name);
-                if (fromOauth !== undefined)
-                    return fromOauth;
-                return env()?.get(name)?.value ?? undefined;
-            },
-            listAll: async () => {
-                const list = [];
-                // OAuth wins on name collision (reserved namespace policy)
-                const oauthList = oauth()?.list() ?? [];
-                const oauthNames = new Set(oauthList.map((e) => e.name));
-                for (const e of oauthList)
-                    list.push({ name: e.name, value: e.value, domains: e.domains });
-                const envEntries = env()?.list() ?? [];
-                for (const entry of envEntries) {
-                    const secret = env()?.get(entry.name);
-                    if (!secret || oauthNames.has(entry.name))
-                        continue;
-                    list.push({ name: secret.name, value: secret.value, domains: secret.domains });
-                }
-                return list;
-            },
-        };
+        return buildFetchProxySecretSource(() => this._envStore, () => this._oauthStore);
     }
     setOauthStore(store) {
         this._oauthStore = store;

package/dist/node-server/secrets/session-id-file.d.ts

@@ -2,4 +2,8 @@
  * Read the session-id from `<dir>/session-id`; if missing/empty/corrupt, generate
  * a fresh UUID, write it (mode 0600), and return that. Idempotent on subsequent calls.
  */
-export declare function readOrCreateSessionId(dir: string): string;
+export declare function readOrCreateSessionId(dir: string, options?: {
+    chmod?: (path: string, mode: number) => void;
+    platform?: NodeJS.Platform;
+    reportError?: (...args: unknown[]) => void;
+}): string;

package/dist/node-server/secrets/session-id-file.js

@@ -6,7 +6,7 @@ const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
  * Read the session-id from `<dir>/session-id`; if missing/empty/corrupt, generate
  * a fresh UUID, write it (mode 0600), and return that. Idempotent on subsequent calls.
  */
-export function readOrCreateSessionId(dir) {
+export function readOrCreateSessionId(dir, options = {}) {
     mkdirSync(dir, { recursive: true });
     const path = join(dir, 'session-id');
     if (existsSync(path)) {
@@ -17,7 +17,7 @@ export function readOrCreateSessionId(dir) {
     const fresh = randomUUID();
     writeFileSync(path, fresh + '\n', { encoding: 'utf-8' });
     try {
-        chmodSync(path, 0o600);
+        (options.chmod ?? chmodSync)(path, 0o600);
     }
     catch (err) {
         // Windows ignores POSIX modes — silent failure is fine.
@@ -25,8 +25,8 @@ export function readOrCreateSessionId(dir) {
         // session-id is the HMAC key that prevents lookup-table attacks on
         // leaked masks (see docs/architecture.md), so EPERM/EACCES here is
         // a real degradation — surface it.
-        if (process.platform !== 'win32') {
-            console.error(`[session-id] chmod 0600 failed at ${path}; session-id may be world-readable`, err instanceof Error ? err.message : String(err));
+        if ((options.platform ?? process.platform) !== 'win32') {
+            (options.reportError ?? console.error)(`[session-id] chmod 0600 failed at ${path}; session-id may be world-readable`, err instanceof Error ? err.message : String(err));
         }
     }
     return fresh;

package/dist/node-server/secrets/sign-and-forward.d.ts

@@ -19,9 +19,17 @@
  * Logging contract: never log envelope contents — request bodies or the
  * `imsToken` may contain credential material.
  */
+import { type SignAndForwardErrorCode } from '../_shared/index.js';
 import type { Request, Response } from 'express';
 import type { SecretStore } from './types.js';
 export type { DaSignAndForwardEnvelope, S3SignAndForwardEnvelope } from '../_shared/index.js';
+/**
+ * Map a structured failure code onto the HTTP status the CLI float returns.
+ * Setup/validation errors are client errors (400); an upstream fetch failure
+ * is a bad gateway (502); an internal error is 500. The `never` default makes
+ * a future addition to `SignAndForwardErrorCode` fail the typecheck here.
+ */
+export declare function statusForErrorCode(code: SignAndForwardErrorCode): number;
 /**
  * Handle a `POST /api/s3-sign-and-forward` request. Validates the envelope,
  * resolves credentials, signs, forwards, returns a JSON envelope.

package/dist/node-server/secrets/sign-and-forward.js

@@ -26,7 +26,7 @@ import { executeDaSignAndForward, executeS3SignAndForward, } from '../_shared/in
  * is a bad gateway (502); an internal error is 500. The `never` default makes
  * a future addition to `SignAndForwardErrorCode` fail the typecheck here.
  */
-function statusForErrorCode(code) {
+export function statusForErrorCode(code) {
     switch (code) {
         case 'invalid_profile':
         case 'invalid_request':

package/dist/node-server/sudo/select.d.ts

@@ -22,6 +22,8 @@ export interface SudoEnv {
 }
 /** Probe the live environment. */
 export declare function detectSudoEnv(): SudoEnv;
+/** Synchronous best-effort `which`; false when the binary is absent. */
+export declare function defaultWhich(cmd: string): boolean;
 /**
  * Select the highest-priority available backend for the given environment.
  * Always returns a backend — the deny backend is the fail-closed terminal.

package/dist/node-server/sudo/select.js

@@ -26,7 +26,7 @@ export function detectSudoEnv() {
     };
 }
 /** Synchronous best-effort `which`; false when the binary is absent. */
-function defaultWhich(cmd) {
+export function defaultWhich(cmd) {
     try {
         const probe = process.platform === 'win32' ? 'where' : 'which';
         execFileSync(probe, [cmd], { stdio: 'ignore' });

package/dist/node-server/sudo/tty-backend.d.ts

@@ -13,5 +13,6 @@ export interface TtyDeps {
     output?: NodeJS.WritableStream;
     createRl?: () => Pick<ReadlineInterface, 'question' | 'close'>;
 }
+export declare function defaultRl(): Pick<ReadlineInterface, 'question' | 'close'>;
 /** Create the editable-TTY backend. */
 export declare function createTtyBackend(deps?: TtyDeps): SudoBackend;

package/dist/node-server/sudo/tty-backend.js

@@ -7,7 +7,7 @@
  * suggested default). Fail closed: a closed stream, EOF, or any error denies.
  */
 import { createInterface } from 'readline';
-function defaultRl() {
+export function defaultRl() {
     return createInterface({ input: process.stdin, output: process.stdout });
 }
 function ask(rl, query) {