feat(cli): support env-backed server headers (#1539)

brosand committed 3 months ago

Commit 01663af1 parent 8ba64f610 files · +538 −43Browse files

Showing the changes to apps/cli/src (5 of 10 files). Show all

Unified · Split

5 files

apps/cli/src/device-login.test.ts +118 −2
apps/cli/src/device-login.ts +57 −8
apps/cli/src/main.ts +100 −32
apps/cli/src/server-profile.test.ts +15 −0
apps/cli/src/server-profile.ts +6 −0

apps/cli/src/device-login.test.ts+118−2

@@ -1,6 +1,44 @@
1	import { describe, expect, it } from "@effect/vitest";	1	import { afterEach, describe, expect, it } from "@effect/vitest";
2		2
3	import { browserOpenCommand } from "./device-login";	3	import {
		4	browserOpenCommand,
		5	discoverCliLogin,
		6	refreshDeviceTokens,
		7	requestDeviceCode,
		8	type CliLoginDiscovery,
		9	} from "./device-login";
		10
		11	const originalFetch = globalThis.fetch;
		12
		13	interface FetchCall {
		14	readonly url: string;
		15	readonly headers: Record<string, string>;
		16	}
		17
		18	const responseJson = (body: Record<string, unknown>, status = 200): Response =>
		19	new Response(JSON.stringify(body), {
		20	status,
		21	headers: { "content-type": "application/json" },
		22	});
		23
		24	const installFetch = (handler: (url: string, init: RequestInit \| undefined) => Response) => {
		25	globalThis.fetch = ((input: RequestInfo \| URL, init?: RequestInit) => {
		26	const url =
		27	typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
		28	return Promise.resolve(handler(url, init));
		29	}) as typeof fetch;
		30	};
		31
		32	const recordCall = (calls: Array<FetchCall>, url: string, init: RequestInit \| undefined): void => {
		33	calls.push({
		34	url,
		35	headers: Object.fromEntries(new Headers(init?.headers).entries()),
		36	});
		37	};
		38
		39	afterEach(() => {
		40	globalThis.fetch = originalFetch;
		41	});
4		42
5	describe("browserOpenCommand", () => {	43	describe("browserOpenCommand", () => {
6	it("opens Windows browser URLs without cmd.exe", () => {	44	it("opens Windows browser URLs without cmd.exe", () => {
@@ -32,3 +70,81 @@ describe("browserOpenCommand", () => { · 25 unmodified lines
32	expect(browserOpenCommand("not a url", "win32")).toBeUndefined();	70	expect(browserOpenCommand("not a url", "win32")).toBeUndefined();
33	});	71	});
34	});	72	});
		73
		74	describe("device login headers", () => {
		75	it("sends configured headers when discovering CLI login", async () => {
		76	const calls: Array<FetchCall> = [];
		77	installFetch((url, init) => {
		78	recordCall(calls, url, init);
		79	return responseJson({
		80	provider: "better-auth",
		81	deviceAuthorizationEndpoint: "https://executor.example/api/auth/device/code",
		82	tokenEndpoint: "https://executor.example/api/auth/device/token",
		83	clientId: "executor-cli",
		84	requestFormat: "json",
		85	});
		86	});
		87
		88	const discovery = await discoverCliLogin("https://executor.example", {
		89	headers: { "CF-Access-Client-Id": "client-id" },
		90	});
		91
		92	expect(discovery.clientId).toBe("executor-cli");
		93	expect(calls).toHaveLength(1);
		94	expect(calls[0]?.url).toBe("https://executor.example/api/auth/cli-login");
		95	expect(calls[0]?.headers).toMatchObject({
		96	accept: "application/json",
		97	"cf-access-client-id": "client-id",
		98	});
		99	});
		100
		101	it("sends configured headers only to same-origin device endpoints", async () => {
		102	const calls: Array<FetchCall> = [];
		103	installFetch((url, init) => {
		104	recordCall(calls, url, init);
		105	if (url.endsWith("/api/auth/device/code")) {
		106	return responseJson({
		107	device_code: "device-code",
		108	user_code: "USER-CODE",
		109	verification_uri: "https://executor.example/device",
		110	expires_in: 300,
		111	interval: 5,
		112	});
		113	}
		114	return responseJson({
		115	access_token: "access-token",
		116	refresh_token: "refresh-token-2",
		117	expires_in: 600,
		118	});
		119	});
		120	const discovery: CliLoginDiscovery = {
		121	provider: "better-auth",
		122	deviceAuthorizationEndpoint: "https://executor.example/api/auth/device/code",
		123	tokenEndpoint: "https://accounts.example/oauth/token",
		124	clientId: "executor-cli",
		125	requestFormat: "form",
		126	};
		127	const headers = { "CF-Access-Client-Id": "client-id" };
		128
		129	await requestDeviceCode(discovery, { serverOrigin: "https://executor.example", headers });
		130	await refreshDeviceTokens({
		131	tokenEndpoint: discovery.tokenEndpoint,
		132	clientId: discovery.clientId,
		133	refreshToken: "refresh-token",
		134	serverOrigin: "https://executor.example",
		135	headers,
		136	});
		137
		138	expect(calls).toHaveLength(2);
		139	expect(calls[0]?.headers).toMatchObject({
		140	accept: "application/json",
		141	"content-type": "application/x-www-form-urlencoded",
		142	"cf-access-client-id": "client-id",
		143	});
		144	expect(calls[1]?.headers).toMatchObject({
		145	accept: "application/json",
		146	"content-type": "application/x-www-form-urlencoded",
		147	});
		148	expect(calls[1]?.headers["cf-access-client-id"]).toBeUndefined();
		149	});
		150	});

apps/cli/src/device-login.ts+57−8

   readonly organizationId?: string;
 }
+export interface DeviceLoginHttpOptions {
+  readonly headers?: Readonly<Record<string, string>>;
+  readonly serverOrigin?: string;
+}
+export interface PollForDeviceTokensOptions extends DeviceLoginHttpOptions {
+  readonly now?: () => number;
+}
 const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
 const DEFAULT_INTERVAL_SECONDS = 5;
     string
   >;
+const isSameOrigin = (url: string, origin: string): boolean => {
+  try {
+    return new URL(url).origin === new URL(origin).origin;
+  } catch {
+    return false;
+  }
+};
+const headersForUrl = (
+  url: string,
+  baseHeaders: Record<string, string>,
+  options: DeviceLoginHttpOptions = {},
+): Record<string, string> => {
+  const configured =
+    options.headers && (!options.serverOrigin || isSameOrigin(url, options.serverOrigin))
+      ? options.headers
+      : {};
+  return { ...configured, ...baseHeaders };
+};
 const post = async (
   url: string,
   fields: Record<string, string | undefined>,
   format: "form" | "json",
+  options: DeviceLoginHttpOptions = {},
 ) =>
   fetch(url, {
     method: "POST",
-    headers: {
+    headers: headersForUrl(
-      "content-type": format === "json" ? "application/json" : "application/x-www-form-urlencoded",
+      url,
-      accept: "application/json",
+      {
-    },
+        "content-type":
+          format === "json" ? "application/json" : "application/x-www-form-urlencoded",
+        accept: "application/json",
+      },
+      options,
+    ),
     body: format === "json" ? JSON.stringify(definedFields(fields)) : formBody(fields),
   });
   }
 };
-export const discoverCliLogin = async (origin: string): Promise<CliLoginDiscovery> => {
+export const discoverCliLogin = async (
+  origin: string,
+  options: DeviceLoginHttpOptions = {},
+): Promise<CliLoginDiscovery> => {
   let response: Response;
+  const url = cliLoginUrl(origin);
   try {
-    response = await fetch(cliLoginUrl(origin), { headers: { accept: "application/json" } });
+    response = await fetch(url, {
+      headers: headersForUrl(url, { accept: "application/json" }, options),
+    });
   } catch (cause) {
     throw new DeviceLoginError(
       `Could not reach ${origin} to start login: ${cause instanceof Error ? cause.message : String(cause)}`,
   };
 };
-export const requestDeviceCode = async (discovery: CliLoginDiscovery): Promise<DeviceCodeGrant> => {
+export const requestDeviceCode = async (
+  discovery: CliLoginDiscovery,
+  options: DeviceLoginHttpOptions = {},
+): Promise<DeviceCodeGrant> => {
   const response = await post(
     discovery.deviceAuthorizationEndpoint,
     { client_id: discovery.clientId, scope: discovery.scope },
     discovery.requestFormat,
+    options,
   );
   const body = await readJson(response);
   if (!response.ok) {
 export const pollForDeviceTokens = async (
   discovery: CliLoginDiscovery,
   grant: DeviceCodeGrant,
-  options: { readonly now?: () => number } = {},
+  options: PollForDeviceTokensOptions = {},
 ): Promise<DeviceTokens> => {
   const now = options.now ?? (() => Date.now());
   const deadline = now() + grant.expiresInSeconds * 1000;
         client_id: discovery.clientId,
       },
       discovery.requestFormat,
+      options,
     );
     const body = await readJson(response);
   readonly tokenEndpoint: string;
   readonly clientId: string;
   readonly refreshToken: string;
+  readonly headers?: Readonly<Record<string, string>>;
+  readonly serverOrigin?: string;
 }): Promise<DeviceTokens> => {
   const response = await post(
     input.tokenEndpoint,
       client_id: input.clientId,
     },
     "form",
+    input,
   );
   const body = await readJson(response);
   if (!response.ok) {

apps/cli/src/main.ts+100−32

   getExecutorServerAuthorizationHeader,
   normalizeExecutorServerConnection,
   normalizeExecutorServerOrigin,
+  resolveExecutorServerConfiguredHeaders,
+  resolveExecutorServerRequestHeaders,
   type ExecutorLocalServerKind,
   type ExecutorLocalServerManifest,
   type ExecutorServerConnection,
   type ExecutorServerConnectionInput,
+  type ExecutorServerHeaders,
 } from "@executor-js/sdk/shared";
 import {
   decodeAccessTokenClaims,
 const refreshOAuthConnection = (
   connection: ExecutorServerConnection,
-): Effect.Effect<ExecutorServerConnection, never, FileSystem.FileSystem | PlatformPath.Path> =>
+): Effect.Effect<ExecutorServerConnection, Error, FileSystem.FileSystem | PlatformPath.Path> =>
   Effect.gen(function* () {
     const auth = connection.auth;
     if (!auth || auth.kind !== "oauth") return connection;
     const { refreshToken, tokenEndpoint, clientId } = auth;
     if (!refreshToken || !tokenEndpoint || !clientId) return connection;
+    const headers = yield* resolveExecutorServerConfiguredHeaders(connection, process.env).pipe(
+      Effect.mapError(toError),
+    );
     const refreshed = yield* Effect.tryPromise({
-      try: () => refreshDeviceTokens({ tokenEndpoint, clientId, refreshToken }),
+      try: () =>
+        refreshDeviceTokens({
+          tokenEndpoint,
+          clientId,
+          refreshToken,
+          serverOrigin: connection.origin,
+          headers,
+        }),
       catch: toError,
       // On a failed refresh, keep the existing token and let the eventual 401
       // surface, better than blocking the command on a transient hiccup.
 // Typed API client
 // ---------------------------------------------------------------------------
-const makeApiClient = (connection: ExecutorServerConnection, target: ServerTarget = {}) => {
+const makeApiClient = (connection: ExecutorServerConnection, target: ServerTarget = {}) =>
-  const authorization = getExecutorServerAuthorizationHeader(connection);
+  Effect.gen(function* () {
-  return HttpApiClient.make(ExecutorApi, {
+    const headers = yield* resolveExecutorServerRequestHeaders(connection, process.env).pipe(
-    baseUrl: connection.apiBaseUrl,
+      Effect.mapError(toError),
-    ...(authorization
+    );
-      ? {
+    return yield* HttpApiClient.make(ExecutorApi, {
-          transformClient: HttpClient.mapRequest((request) =>
+      baseUrl: connection.apiBaseUrl,
-            HttpClientRequest.setHeader(request, "authorization", authorization),
+      ...(Object.keys(headers).length > 0
-          ),
+        ? {
-        }
+            transformClient: HttpClient.mapRequest((request) =>
-      : {}),
+              HttpClientRequest.setHeaders(request, headers),
-    // A 401 on an endpoint that doesn't model it is a sign-in problem: rewrite
+            ),
-    // the transport-level error into the login hint. Without this the client
+          }
-    // fails decoding the unexpected status and prints the opaque
+        : {}),
-    // `Decode error (401 GET .../api/tools)`. Declared 401s (typed API errors)
+      // A 401 on an endpoint that doesn't model it is a sign-in problem: rewrite
-    // decode before this catch and pass through untouched.
+      // the transport-level error into the login hint. Without this the client
-    transformResponse: (effect) =>
+      // fails decoding the unexpected status and prints the opaque
-      Effect.catchIf(
+      // `Decode error (401 GET .../api/tools)`. Declared 401s (typed API errors)
-        effect,
+      // decode before this catch and pass through untouched.
-        (cause) => HttpClientError.isHttpClientError(cause) && cause.response?.status === 401,
+      transformResponse: (effect) =>
-        () =>
+        Effect.catchIf(
-          Effect.fail(new Error(describeUnauthorizedCliServer({ connection, cliPrefix, target }))),
+          effect,
-      ),
+          (cause) => HttpClientError.isHttpClientError(cause) && cause.response?.status === 401,
+          () =>
+            Effect.fail(
+              new Error(describeUnauthorizedCliServer({ connection, cliPrefix, target })),
+            ),
+        ),
+    });
   }).pipe(Effect.provide(FetchHttpClient.layer));
-};
 // ---------------------------------------------------------------------------
 // Foreground session
   Command.withDescription("Discover available tools and integrations"),
 );
+const HEADER_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+const ENV_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const parseHeaderEnvOption = (
+  headerEnv: Option.Option<Record<string, string>>,
+): ExecutorServerHeaders | undefined => {
+  const values = Option.getOrUndefined(headerEnv);
+  if (!values) return undefined;
+  const headers: Record<string, { readonly kind: "env"; readonly name: string }> = {};
+  for (const [rawHeaderName, rawEnvName] of Object.entries(values)) {
+    const headerName = rawHeaderName.trim();
+    const envName = rawEnvName.trim();
+    if (!HEADER_NAME_PATTERN.test(headerName)) {
+      throw new Error(
+        `Invalid --header-env header name "${rawHeaderName}". Use an HTTP header token like CF-Access-Client-Id.`,
+      );
+    }
+    if (!ENV_NAME_PATTERN.test(envName)) {
+      throw new Error(
+        `Invalid --header-env env name "${rawEnvName}". Use an environment variable name like EXECUTOR_CF_ACCESS_CLIENT_ID.`,
+      );
+    }
+    headers[headerName] = { kind: "env", name: envName };
+  }
+  return Object.keys(headers).length > 0 ? headers : undefined;
+};
 const profileConnectionInput = (input: {
   readonly origin: string;
   readonly displayName: Option.Option<string>;
   readonly kind: Option.Option<"http" | "desktop-sidecar">;
+  readonly headerEnv: Option.Option<Record<string, string>>;
 }): ExecutorServerConnectionInput => {
   const selectedKind = Option.getOrUndefined(input.kind);
   const displayName = Option.getOrUndefined(input.displayName);
+  const headers = parseHeaderEnvOption(input.headerEnv);
   return {
     kind: selectedKind ?? "http",
     origin: input.origin,
     ...(displayName ? { displayName } : {}),
+    ...(headers ? { headers } : {}),
   };
 };
       origin: profile.connection.origin,
       displayName: profile.connection.displayName,
       auth: profile.connection.auth ? "stored-auth" : "env-auth",
+      headers: profile.connection.headers
+        ? `${Object.keys(profile.connection.headers).length} header-env`
+        : "no-headers",
     }));
     const nameWidth = rows.reduce((max, row) => Math.max(max, row.name.length), 4);
     const kindWidth = rows.reduce((max, row) => Math.max(max, row.kind.length), 4);
     for (const row of rows) {
       console.log(
-        `${row.marker} ${row.name.padEnd(nameWidth)}  ${row.kind.padEnd(kindWidth)}  ${row.origin}  ${row.displayName}  ${row.auth}`,
+        `${row.marker} ${row.name.padEnd(nameWidth)}  ${row.kind.padEnd(kindWidth)}  ${row.origin}  ${row.displayName}  ${row.auth}  ${row.headers}`,
       );
     }
   });
       Options.optional,
       Options.withDescription("Server kind. Defaults to http."),
     ),
+    headerEnv: Options.keyValuePair("header-env").pipe(
+      Options.optional,
+      Options.withDescription(
+        "HTTP header mapping header-name=ENV_VAR. Repeat for Cloudflare Access service tokens.",
+      ),
+    ),
     makeDefault: Options.boolean("default").pipe(
       Options.withDefault(false),
       Options.withDescription("Make this profile the default server."),
     ),
   },
-  ({ name, origin, displayName, kind, makeDefault }) =>
+  ({ name, origin, displayName, kind, headerEnv, makeDefault }) =>
     Effect.gen(function* () {
       const profileName = validateCliServerConnectionProfileName(name);
       const store = yield* upsertCliServerConnectionProfile({
         name: profileName,
-        connection: profileConnectionInput({ origin, displayName, kind }),
+        connection: profileConnectionInput({ origin, displayName, kind, headerEnv }),
         makeDefault,
       });
       const profile = findCliServerConnectionProfile(store, profileName);
       // The target may have been picked implicitly (default profile, or the
       // hosted fallback): say where the login is going before the device flow.
       console.log(`Signing in to ${target.origin}`);
+      const targetProfile = target.profile;
+      const headers = targetProfile
+        ? yield* resolveExecutorServerConfiguredHeaders(targetProfile.connection, process.env).pipe(
+            Effect.mapError(toError),
+          )
+        : {};
       const discovery = yield* Effect.tryPromise({
-        try: () => discoverCliLogin(target.origin),
+        try: () => discoverCliLogin(target.origin, { headers }),
         catch: toError,
       });
       const grant = yield* Effect.tryPromise({
-        try: () => requestDeviceCode(discovery),
+        try: () => requestDeviceCode(discovery, { serverOrigin: target.origin, headers }),
         catch: toError,
       });
       const verifyUrl = grant.verificationUriComplete ?? grant.verificationUri;
       if (!noBrowser) openBrowser(verifyUrl);
       console.log("Waiting for you to approve in the browser...");
       const tokens = yield* Effect.tryPromise({
-        try: () => pollForDeviceTokens(discovery, grant),
+        try: () => pollForDeviceTokens(discovery, grant, { serverOrigin: target.origin, headers }),
         catch: toError,
       });
           kind: "http",
           origin: target.origin,
           ...(email ? { displayName: email } : {}),
+          ...(target.profile?.connection.headers
+            ? { headers: target.profile.connection.headers }
+            : {}),
           auth: {
             kind: "oauth",
             accessToken: tokens.accessToken,
           kind: profile.connection.kind,
           origin: profile.connection.origin,
           displayName: profile.connection.displayName,
+          ...(profile.connection.headers ? { headers: profile.connection.headers } : {}),
         },
         makeDefault: store.defaultProfile === profile.name,
       });

apps/cli/src/server-profile.test.ts+15−0

           connection: {
             origin: "https://executor.example/api",
             auth: { kind: "bearer", token: "key_123" },
+            headers: {
+              "CF-Access-Client-Id": { kind: "env", name: "EXECUTOR_CF_ACCESS_CLIENT_ID" },
+            },
           },
           makeDefault: true,
         });
           kind: "bearer",
           token: "key_123",
         });
+        expect(store.profiles[0]?.connection.headers).toEqual({
+          "CF-Access-Client-Id": { kind: "env", name: "EXECUTOR_CF_ACCESS_CLIENT_ID" },
+        });
         expect(defaultCliServerConnectionProfile(store)?.name).toBe("remote");
       } finally {
         rmSync(dataDir, { recursive: true, force: true });
               key: "desktop-sidecar",
               origin: "http://127.0.0.1:4789",
               auth: { kind: "basic", username: "executor", password: "secret" },
+              headers: {
+                "CF-Access-Client-Id": {
+                  kind: "env",
+                  name: "EXECUTOR_CF_ACCESS_CLIENT_ID",
+                },
+              },
             },
           },
         ],
       username: "executor",
       password: "secret",
     });
+    expect(store.profiles[0]?.connection.headers).toEqual({
+      "CF-Access-Client-Id": { kind: "env", name: "EXECUTOR_CF_ACCESS_CLIENT_ID" },
+    });
   });
 });

apps/cli/src/server-profile.ts+6−0

   }),
 ]);
+const PersistedHeader = Schema.Struct({
+  kind: Schema.Literal("env"),
+  name: Schema.String,
+});
 const PersistedConnection = Schema.Struct({
   kind: Schema.optional(Schema.Literals(["http", "desktop-sidecar"])),
   key: Schema.optional(Schema.String),
   apiBaseUrl: Schema.optional(Schema.String),
   displayName: Schema.optional(Schema.String),
   auth: Schema.optional(PersistedAuth),
+  headers: Schema.optional(Schema.Record(Schema.String, PersistedHeader)),
 });
 const PersistedProfile = Schema.Struct({

feat(cli): support env-backed server headers (#1539)

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code