with-authorization-class

Author: isc-klu

src/api/index.ts

@@ -12,15 +12,14 @@ import {
   schemas,
   checkingConnection,
   inactiveServerIds,
-  serverManagerApi,
 } from "../extension";
 import { currentWorkspaceFolder, outputChannel, outputConsole } from "../utils";
 
 const DEFAULT_API_VERSION = 1;
 const DEFAULT_SERVER_VERSION = "2016.2.0";
 import * as Atelier from "./atelier";
 import { isfsConfig } from "../utils/FileProviderUtil";
-import { IServerSpec } from "@intersystems-community/intersystems-servermanager";
+import { Authorization, IServerSpec } from "@intersystems-community/intersystems-servermanager";
 
 // Map of the authRequest promises for each username@host:port/pathPrefix target to avoid concurrency issues
 const authRequestMap = new Map<string, Promise<any>>();
@@ -39,9 +38,8 @@ interface ConnectionSettings {
   superserverPort?: number;
   pathPrefix: string;
   ns: string;
-  authMethod: "password" | "oauth2";
-  username: string;
-  password: string;
+  authorization: Authorization;
+  password?: string;
   docker: boolean;
   dockerService?: string;
 }
@@ -62,15 +60,18 @@ export class AtelierAPI {
   }
 
   public get config(): ConnectionSettings {
-    const { serverName, active = false, https = false, pathPrefix = "", authMethod, username } = this._config;
+    const { serverName, active = false, https = false, pathPrefix = "", authorization } = this._config;
     const ns = this.namespace || this._config.ns;
     const wsKey = this.configName.toLowerCase();
     const host = this.externalServer ? this._config.host : workspaceState.get(wsKey + ":host", this._config.host);
     const port = this.externalServer ? this._config.port : workspaceState.get(wsKey + ":port", this._config.port);
     const superserverPort = this.externalServer
       ? this._config.superserverPort
       : workspaceState.get(wsKey + ":superserverPort", this._config.superserverPort);
-    const password = workspaceState.get(wsKey + ":password", this._config.password);
+    const password = workspaceState.get(wsKey + ":password", undefined);
+    if (password !== undefined) {
+      authorization.resolve(password);
+    }
     const apiVersion = workspaceState.get(wsKey + ":apiVersion", DEFAULT_API_VERSION);
     const serverVersion = workspaceState.get(wsKey + ":serverVersion", DEFAULT_SERVER_VERSION);
     const docker = workspaceState.get(wsKey + ":docker", false);
@@ -86,9 +87,7 @@ export class AtelierAPI {
       superserverPort,
       pathPrefix,
       ns,
-      authMethod,
-      username,
-      password,
+      authorization,
       docker,
       dockerService,
     };
@@ -154,13 +153,9 @@ export class AtelierAPI {
   public setConnSpec(serverName: string, connSpec: IServerSpec): void {
     const {
       webServer: { scheme, host, port, pathPrefix = "" },
-      authMethod = "password",
-      username,
-      password,
+      authorization,
     } = connSpec;
-    this._config.authMethod = authMethod;
-    this._config.username = username;
-    this._config.password = password;
+    this._config.authorization = authorization;
     this._config.https = scheme == "https";
     this._config.host = host;
     this._config.port = port;
@@ -215,7 +210,8 @@ export class AtelierAPI {
 
   /** Return the key for getting values from connection-specific Maps for this connection */
   private mapKey(): string {
-    const { host, port, username } = this.config;
+    const { host, port, authorization } = this.config;
+    const username = authorization.resolved() ? authorization.username : "";
     let pathPrefix = this._config.pathPrefix || "";
     if (pathPrefix.length && !pathPrefix.startsWith("/")) {
       pathPrefix = "/" + pathPrefix;
@@ -245,9 +241,7 @@ export class AtelierAPI {
     if (serverName !== "") {
       const {
         webServer: { scheme, host, port, pathPrefix = "" },
-        authMethod,
-        username,
-        password,
+        authorization,
         superServer,
       } = getResolvedConnectionSpec(serverName, config("intersystems.servers", workspaceFolderName).get(serverName));
       this._config = {
@@ -260,9 +254,7 @@ export class AtelierAPI {
         host,
         port,
         superserverPort: superServer?.port,
-        authMethod,
-        username,
-        password,
+        authorization,
         pathPrefix,
         docker: false,
       };
@@ -272,9 +264,7 @@ export class AtelierAPI {
       if (resolvedSpec) {
         const {
           webServer: { scheme, host, port, pathPrefix = "" },
-          authMethod,
-          username,
-          password,
+          authorization,
           superServer,
         } = resolvedSpec;
         this._config = {
@@ -287,9 +277,7 @@ export class AtelierAPI {
           host,
           port,
           superserverPort: superServer?.port,
-          authMethod,
-          username,
-          password,
+          authorization,
           pathPrefix,
           docker: true,
           dockerService: conn["docker-compose"].service,
@@ -380,7 +368,9 @@ export class AtelierAPI {
     let authRequest = authRequestMap.get(mapKey);
     if (cookies.length || (method === "HEAD" && !originalPath)) {
       auth = Promise.resolve(cookies);
-      headers["Authorization"] = serverManagerApi.getAuthorization(this.config);
+      headers["Authorization"] = this.config.authorization.resolved()
+        ? this.config.authorization.httpAuthorizationHeader
+        : "";
     } else if (!cookies.length) {
       if (!authRequest) {
         // Recursion point

src/commands/connectFolderToServerNamespace.ts

@@ -80,7 +80,7 @@ export async function connectFolderToServerNamespace(): Promise<void> {
     .serverInfo(false)
     .then((data) => data.result.content.namespaces)
     .catch(async (error) => {
-      if (error?.statusCode == 401 && isUnauthenticated(api.config.username)) {
+      if (error?.statusCode == 401 && isUnauthenticated(api.config.authorization.username)) {
         // Attempt to resolve username and password and try again
         const newSpec = await resolveUsernameAndPassword(api.config.serverName, connSpec);
         if (newSpec) {

src/commands/restDebugPanel.ts

@@ -3,7 +3,7 @@ import * as httpsModule from "https";
 import * as vscode from "vscode";
 import { AtelierAPI } from "../api";
 import { handleError, webviewCSS } from "../utils";
-import { iscIcon, serverManagerApi } from "../extension";
+import { iscIcon } from "../extension";
 
 interface WebviewMessage {
   /** Whether this message was triggered by the user pressing the 'Start Debugging' button */
@@ -548,7 +548,9 @@ export class RESTDebugPanel {
                   .trim();
               }
             });
-            headers["authorization"] = headers["authorization"] ?? serverManagerApi.getAuthorization(api.config);
+            headers["authorization"] =
+              headers["authorization"] ??
+              (api.config.authorization.resolved() ? api.config.authorization.httpAuthorizationHeader : "");
             const hasBody =
               typeof message.bodyContent == "string" && message.bodyContent != "" && message.bodyType != "No Body";
             if (hasBody) {

src/commands/serverActions.ts

@@ -25,7 +25,8 @@ type ServerAction = { detail: string; id: string; label: string; rawLink?: strin
 export async function serverActions(): Promise<void> {
   const { apiTarget, configName: workspaceFolder } = connectionTarget();
   const api = new AtelierAPI(apiTarget);
-  const { active, host = "", ns = "", https, port = 0, pathPrefix, username, docker } = api.config;
+  const { active, host = "", ns = "", https, port = 0, pathPrefix, authorization, docker } = api.config;
+  const username = authorization.username;
   const explorerCount = (await explorerProvider.getChildren()).length;
   if (!explorerCount && (!docker || host === "")) {
     await vscode.commands.executeCommand("ObjectScriptExplorer.focus");

src/commands/webSocketTerminal.ts

@@ -225,7 +225,7 @@ class WebSocketTerminal implements vscode.Pseudoterminal {
     this._hideCursorWrite("\x1b]633;P;HasRichCommandDetection=True\x07");
     // Print the opening message
     this._hideCursorWrite(
-      `\x1b[32mConnected to \x1b[0m\x1b[4m${api.config.host}:${api.config.port}${api.config.pathPrefix}\x1b[0m\x1b[32m as \x1b[0m\x1b[3m${api.config.username}\x1b[0m\r\n`
+      `\x1b[32mConnected to \x1b[0m\x1b[4m${api.config.host}:${api.config.port}${api.config.pathPrefix}\x1b[0m\x1b[32m as \x1b[0m\x1b[3m${api.config.authorization.username}\x1b[0m\r\n`
     );
     // Add event handlers to the socket
     this._socket

src/extension.ts

@@ -209,7 +209,7 @@ export let checkingConnection = false;
 export let serverManagerApi: serverManager.ServerManagerAPI;
 
 /** Map of the intersystems.server connection specs we have resolved via the API to that extension */
-const resolvedConnSpecs = new Map<string, serverManager.IServerSpec>();
+const resolvedConnSpecs = new Map<string, serverManager.IServerSpec & { accessToken?: string }>();
 
 /**
  * If servermanager extension is available, fetch the connection spec unless already cached.
@@ -255,8 +255,7 @@ export async function resolveConnectionSpec(
           superServer: {
             port: serverForUri.superserverPort,
           },
-          username: serverForUri.username,
-          password: serverForUri.password ? serverForUri.password : undefined,
+          authorization: serverManagerApi.makeAuthorization(serverForUri.username, serverForUri.password),
           description: `Server for workspace folder '${serverName}'`,
         };
       }
@@ -269,14 +268,12 @@ export async function resolveConnectionSpec(
   }
 }
 
-async function resolvePassword(serverSpec, ignoreUnauthenticated = false): Promise<void> {
-  if (
-    // Connection isn't unauthenticated
-    (!isUnauthenticated(serverSpec.username) || ignoreUnauthenticated) &&
-    // A password is missing
-    typeof serverSpec.password == "undefined"
-  ) {
-    const scopes = [serverSpec.name, serverSpec.username || ""];
+async function resolvePassword(
+  serverSpec: Pick<serverManager.IServerSpec, "name" | "authorization">,
+  ignoreUnauthenticated = false
+): Promise<string | undefined> {
+  if (!(serverSpec.authorization.resolved() || ignoreUnauthenticated)) {
+    const scopes = [serverSpec.name, serverSpec.authorization.username || ""];
 
     // Handle Server Manager extension version < 3.8.0
     const account = serverManagerApi.getAccount ? serverManagerApi.getAccount(serverSpec) : undefined;
@@ -293,25 +290,28 @@ async function resolvePassword(serverSpec, ignoreUnauthenticated = false): Promi
     }
     if (session) {
       // If original spec lacked username use the one obtained from the user by the authprovider (exact case)
-      serverSpec.username = serverSpec.username || session.scopes[1];
-      serverSpec.password = session.accessToken;
+      serverSpec.authorization.resolve(session.accessToken, session.scopes[1]);
+      return session.accessToken;
     }
   }
 }
 
 /** Resolve credentials for `serverName` and returned the complete connection spec if successful */
-export async function resolveUsernameAndPassword(serverName: string, oldSpec: any): Promise<any> {
-  const newSpec: { name: string; username?: string; password?: string } = {
-    name: serverName,
-    username: oldSpec?.username,
-  };
-  await resolvePassword(newSpec, true);
-  if (newSpec.password) {
+export async function resolveUsernameAndPassword(
+  serverName: string,
+  oldSpec: serverManager.IServerSpec
+): Promise<(serverManager.IServerSpec & { accessToken?: string }) | undefined> {
+  const { authorization: _authorization, ...newSpec } = oldSpec;
+  newSpec.name = serverName;
+  const authorization = _authorization.clone();
+
+  const accessToken = await resolvePassword({ ...newSpec, authorization }, true);
+  if (authorization.resolved()) {
     // Update the connection spec
     resolvedConnSpecs.set(serverName, {
       ...oldSpec,
-      username: newSpec.username,
-      password: newSpec.password,
+      authorization,
+      accessToken,
     });
     return resolvedConnSpecs.get(serverName);
   }
@@ -364,7 +364,8 @@ export async function checkConnection(
     _onDidChangeConnection.fire();
   }
   let api = new AtelierAPI(apiTarget, false);
-  const { active, host = "", port = 0, superserverPort = 0, ns = "", username } = api.config;
+  const { active, host = "", port = 0, superserverPort = 0, ns = "", authorization } = api.config;
+  const username = authorization.resolved() ? authorization.username : "";
   vscode.commands.executeCommand("setContext", "vscode-objectscript.connectActive", active);
   if (!panel.text) {
     panel.text = `${PANEL_LABEL}`;
@@ -470,8 +471,7 @@ export async function checkConnection(
         let success = false;
         message = "Not Authorized.";
         errorMessage = `Authorization error: Check your credentials in Settings, and that you have sufficient privileges on the /api/atelier web application on ${connInfo}`;
-        const username = api.config.username;
-        if (isUnauthenticated(username)) {
+        if (isUnauthenticated(api.config.authorization.username)) {
           vscode.window.showErrorMessage(
             `Unauthenticated access rejected by '${api.serverId}'.${
               !api.config.serverName ? " Connection has been disabled." : ""
@@ -487,7 +487,7 @@ export async function checkConnection(
             const newSpec = await resolveUsernameAndPassword(api.config.serverName, oldSpec);
             if (newSpec) {
               // We were able to resolve credentials, so try again
-              await workspaceState.update(wsKey + ":password", newSpec.password);
+              await workspaceState.update(wsKey + ":password", newSpec.accessToken);
               api = new AtelierAPI(apiTarget, false);
               await api
                 .serverInfo(true, serverInfoTimeout)
@@ -515,7 +515,7 @@ export async function checkConnection(
             vscode.window
               .showInputBox({
                 password: true,
-                title: `Not Authorized. Enter password to connect as user '${username}' to ${connInfo}`,
+                title: `Not Authorized. Enter password to connect as user '${api.config.authorization.username}' to ${connInfo}`,
                 prompt: !api.externalServer ? "If no password is entered the connection will be disabled." : "",
                 ignoreFocusOut: true,
               })
@@ -1965,11 +1965,10 @@ export interface GeneralServerForUri {
   namespace: string;
   apiVersion: number;
   serverVersion: string;
+  authorization: serverManager.Authorization;
 }
 
-export type ServerForUri = GeneralServerForUri &
-  HttpsAndScheme &
-  Required<Pick<serverManager.Authorization, "authMethod" | "username" | "password">>;
+export type ServerForUri = GeneralServerForUri & HttpsAndScheme;
 
 // This function is exported as one of our API functions but is also used internally
 // for example to implement the async variant capable of resolving docker port number.
@@ -1989,13 +1988,28 @@ function serverForUri(uri: vscode.Uri): ServerForUri {
     port,
     superserverPort,
     pathPrefix,
-    authMethod,
-    username,
-    password,
+    authorization,
     ns,
     apiVersion,
     serverVersion,
   } = api.config;
+  if (serverName !== "") {
+    const password = vscode.workspace
+      .getConfiguration(
+        `intersystems.servers.${serverName.toLowerCase()}`,
+        // objectscript(xml):// URIs are not in any workspace folder,
+        // so make sure we resolve the server definition with the proper
+        // granularity. This is needed to prevent other extensions like
+        // Language Server prompting for a passwoord when it's not needed.
+        [OBJECTSCRIPT_FILE_SCHEMA, OBJECTSCRIPTXML_FILE_SCHEMA].includes(uri.scheme)
+          ? vscode.workspace.workspaceFolders?.find((f) => f.name.toLowerCase() == configNameLower)?.uri
+          : uri
+      )
+      .get("password") as string | undefined;
+    if (password !== undefined) {
+      authorization.resolve(password);
+    }
+  }
   return {
     serverName,
     active,
@@ -2004,23 +2018,7 @@ function serverForUri(uri: vscode.Uri): ServerForUri {
     port,
     superserverPort,
     pathPrefix,
-    authMethod,
-    username,
-    password:
-      serverName === ""
-        ? password
-        : vscode.workspace
-            .getConfiguration(
-              `intersystems.servers.${serverName.toLowerCase()}`,
-              // objectscript(xml):// URIs are not in any workspace folder,
-              // so make sure we resolve the server definition with the proper
-              // granularity. This is needed to prevent other extensions like
-              // Language Server prompting for a passwoord when it's not needed.
-              [OBJECTSCRIPT_FILE_SCHEMA, OBJECTSCRIPTXML_FILE_SCHEMA].includes(uri.scheme)
-                ? vscode.workspace.workspaceFolders?.find((f) => f.name.toLowerCase() == configNameLower)?.uri
-                : uri
-            )
-            .get("password"),
+    authorization,
     namespace: ns,
     apiVersion: active ? apiVersion : undefined,
     serverVersion: active ? serverVersion : undefined,