From 8ad23b597abac97cc18a29926b4b4ba05819e0f3 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 13 Oct 2026 06:45:16 +0000 Subject: [PATCH 1/2] chore(deps): update dependency @auth0/auth0-spa-js to v2.28.3 --- pnpm-lock.yaml | 42 +++++++++++++++++++++--------------------- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index de69888d..88bfdc06 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -49,7 +49,7 @@ importers: dependencies: '@auth0/auth0-spa-js': specifier: ^2.19.3 - version: 2.24.1 + version: 2.28.3 '@tigrisdata/agent-shell': specifier: workspace:^ version: link:../../packages/agent-shell @@ -171,7 +171,7 @@ importers: dependencies: '@auth0/auth0-spa-js': specifier: ^2.19.3 - version: 2.24.1 + version: 2.28.3 '@tigrisdata/cli': specifier: workspace:^ version: link:../cli @@ -321,11 +321,11 @@ packages: resolution: {integrity: sha512-YnVzxDxLaqL0t7Q4wfcgHZjg55Wm6y5EaO7Bhu3q9J7wq/8iw3PhsnWiOQhYekx4VexnbkgWpTT6n+QIV7kczw==} engines: {node: ^22.22.2 || ^24.15.0 || >=26.0.0} - '@auth0/auth0-auth-js@1.12.1': - resolution: {integrity: sha512-YgYOAGmfwO40YOYkYSW7XvE6b+qkdlXdpzBshvOjCioygesUxIw2qRerilW1/8XQV41mnFvQIPnsTdEOHN9BeA==} + '@auth0/auth0-auth-js@1.16.1': + resolution: {integrity: sha512-dtH12GiKEZ+YGnwUe0LTe7gJtEEAvhE5ztUL3i8iXN7D3siXe/MUssQq735UlXJzasXNqZOQUkMbv1VMXMZj+g==} - '@auth0/auth0-spa-js@2.24.1': - resolution: {integrity: sha512-iS18fBlWWxQ/FPtWgWzYYEImsNRumJG2cZ08xV0HsEmWtTBv+54A+fnyFx9eiNBP7cLp0emwDDjgeG+hQEbVBA==} + '@auth0/auth0-spa-js@2.28.3': + resolution: {integrity: sha512-W4bqoPdzjakJdtzKiOcWT5yMLciR9jeaHHwGydAKRpAkTD80ld2tGDUVL+sTpzaty8i3SL7lakgERiowcl0WCw==} '@aws-crypto/sha256-js@5.2.0': resolution: {integrity: sha512-FFQQyu7edu4ufvIZ+OadFpHHOt+eSTBaYaki44c+akjg7qZg9oOQeLlk77F6tSYqjDAFClrHJk9tMf0HdVyOvA==} @@ -2057,8 +2057,8 @@ packages: resolution: {integrity: sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw==} engines: {node: '>=12'} - dpop@2.1.1: - resolution: {integrity: sha512-J0Of2JTiM4h5si0tlbPQ/lkqfZ5wAEVkKYBhkwyyANnPJfWH4VsR5uIkZ+T+OSPIwDYUg1fbd5Mmodd25HjY1w==} + dpop@2.1.2: + resolution: {integrity: sha512-hN3XjjCcgYWmNL8DFAV1Z3alXIvLolvjis189NI/U4k4Iu/m4rBeUYObbIjnRzQYDQv4zMaXXskjVDqSkmyh7Q==} dunder-proto@1.0.1: resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==} @@ -2751,8 +2751,8 @@ packages: engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0} deprecated: This package is no longer supported. - oauth4webapi@3.8.7: - resolution: {integrity: sha512-4RxcKxXjuItDFZ20RRPf4YTw3kpeXJyCgJFxVzJ068A7PNJ18st2Dg90tlC1LkSDS0GecroagCLHYEIVUhCAkw==} + oauth4webapi@3.8.8: + resolution: {integrity: sha512-8N28E+a/oxfXWBgOMt+ZP/JUf/XR+IFbvkAEPP3gznXOMv9BpAAwiIj0TFNz3tGTPc0ZQ8zmWBNgN1nAys0gng==} object-assign@4.1.1: resolution: {integrity: sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==} @@ -2769,8 +2769,8 @@ packages: resolution: {integrity: sha512-++Zlftm0kVLPmzC06t6epuWmcRMDbI4z5P3NNX979WA/k23+NtSOynEGzsVfZwguKw2mi5umVgnBlJQMwRz4Pg==} engines: {node: '>=20'} - openid-client@6.8.5: - resolution: {integrity: sha512-jNGC/5wnTYwCcEUe2ss0IRUmVRQcgxM0A1nLb3eX/9llqNbMWOQd2xd+qDAgfVCpA5Qh96Y1cdnkfbva6+bSdA==} + openid-client@6.8.8: + resolution: {integrity: sha512-ZsucJA5Ad04Uv7YN4ql+s4GXNmb9uAYQwyJTsJx7CH/MX3JZioLE2pVKi1SC+YrbSLA4Px3Gi30dMjgOZtb6pA==} p-map@4.0.0: resolution: {integrity: sha512-/bjOqmgETBYB5BoEeGVea8dmvHb2m9GLy1E9W43yeyfP6QQCZGFNa+XRceJEuDB6zqr+gKpIAmlLebMpykw/MQ==} @@ -3434,16 +3434,16 @@ snapshots: is-potential-custom-element-name: 1.0.1 lru-cache: 11.5.3 - '@auth0/auth0-auth-js@1.12.1': + '@auth0/auth0-auth-js@1.16.1': dependencies: jose: 6.2.12 - openid-client: 6.8.5 + openid-client: 6.8.8 - '@auth0/auth0-spa-js@2.24.1': + '@auth0/auth0-spa-js@2.28.3': dependencies: - '@auth0/auth0-auth-js': 1.12.1 + '@auth0/auth0-auth-js': 1.16.1 browser-tabs-lock: 1.3.0 - dpop: 2.1.1 + dpop: 2.1.2 es-cookie: 1.3.2 '@aws-crypto/sha256-js@5.2.0': @@ -5126,7 +5126,7 @@ snapshots: dotenv@17.4.2: {} - dpop@2.1.1: {} + dpop@2.1.2: {} dunder-proto@1.0.1: dependencies: @@ -5899,7 +5899,7 @@ snapshots: set-blocking: 2.0.0 optional: true - oauth4webapi@3.8.7: {} + oauth4webapi@3.8.8: {} object-assign@4.1.1: {} @@ -5918,10 +5918,10 @@ snapshots: powershell-utils: 0.2.1 wsl-utils: 1.0.0 - openid-client@6.8.5: + openid-client@6.8.8: dependencies: jose: 6.2.12 - oauth4webapi: 3.8.7 + oauth4webapi: 3.8.8 p-map@4.0.0: dependencies: From 55d8a4056b565f3bd7be16006563ed30f75c9727 Mon Sep 17 00:00:00 2001 From: A Ibrahim Date: Tue, 13 Oct 2026 08:49:40 +0200 Subject: [PATCH 2/2] fix(cli-shell): build against auth0-spa-js 2.25 and later Co-Authored-By: Claude Fable 5.1 Assisted-by: Claude Fable 5.1 via Claude Code --- .changeset/cli-shell-auth0-token-type.md | 5 +++++ packages/cli-shell/src/auth/oauth.ts | 11 +++++++++-- packages/cli-shell/test/oauth.test.ts | 14 ++++++++++++++ 3 files changed, 28 insertions(+), 2 deletions(-) create mode 100644 .changeset/cli-shell-auth0-token-type.md diff --git a/.changeset/cli-shell-auth0-token-type.md b/.changeset/cli-shell-auth0-token-type.md new file mode 100644 index 00000000..0a9dd31c --- /dev/null +++ b/.changeset/cli-shell-auth0-token-type.md @@ -0,0 +1,5 @@ +--- +"@tigrisdata/cli-shell": patch +--- + +Builds against `@auth0/auth0-spa-js` 2.25 and later, where `getTokenSilently` is typed as possibly returning nothing. An empty result — which the modes the shell uses cannot produce — is reported as an error instead of being read as a token. diff --git a/packages/cli-shell/src/auth/oauth.ts b/packages/cli-shell/src/auth/oauth.ts index f9e2675c..f3890d67 100644 --- a/packages/cli-shell/src/auth/oauth.ts +++ b/packages/cli-shell/src/auth/oauth.ts @@ -144,16 +144,23 @@ interface MintedTokens { expiresAt?: number; } -function getSilentToken( +async function getSilentToken( auth0: Auth0Client, config: ResolvedAuth0Config, cacheMode: 'on' | 'off' ) { - return auth0.getTokenSilently({ + const token = await auth0.getTokenSilently({ authorizationParams: { audience: config.audience }, detailedResponse: true, cacheMode, }); + // Since auth0-spa-js 2.25 the result may be undefined, for a cache-only + // lookup that misses. Both modes used here go to the tenant when the cache + // cannot serve, so an empty result means the SDK broke its contract. + if (!token) { + throw new Error('Auth0 returned no token'); + } + return token; } /** The `exp` claim of a JWT, in seconds — or undefined if it is not one. */ diff --git a/packages/cli-shell/test/oauth.test.ts b/packages/cli-shell/test/oauth.test.ts index ded9fe61..d166e0c4 100644 --- a/packages/cli-shell/test/oauth.test.ts +++ b/packages/cli-shell/test/oauth.test.ts @@ -280,6 +280,20 @@ describe('renewAuth0Session', () => { expect(client.getTokenSilently).toHaveBeenCalledTimes(1); }); + it('reports an empty token result instead of dereferencing it', async () => { + // auth0-spa-js 2.25+ types getTokenSilently as possibly undefined (a + // cache-only miss). Neither mode used here can miss, so treat it as a + // broken contract rather than a session. + const client = fakeClient({ + getTokenSilently: vi.fn(async () => undefined), + }); + createAuth0Client.mockResolvedValue(client); + + await expect(renewAuth0Session(options())).rejects.toThrow( + /Auth0 returned no token/ + ); + }); + it('never leaks the tenant audience or scope into the error', async () => { // What the user actually saw: the SDK's raw "Missing Refresh Token // (audience: ..., scope: ...)" plus tenant-config advice, straight to a