Bump to latest deno (#1399)

In the latest deno, Deno.core no longer contains any references to
custom op implementations. Instead, these functions are only accessible
to the internal javascript modules of an extension.

This patch replaces `extensions/phylum.ts` by creating a set of internal
javascript modules in the `cli/js` folder. This means that extension no
longer need to import the "phylum" module and can instead use the global
`Phylum` object directly.

A shim "phylum" module that re-exports the globally available object is
also included for backwards compatibility.

Types are now available in `extensions/phylum.d.ts`

cli/Cargo.toml

@@ -4,7 +4,7 @@ version = "6.3.0"
 authors = ["Phylum, Inc. <engineering@phylum.io>"]
 license = "GPL-3.0-or-later"
 edition = "2021"
-rust-version = "1.74.0"
+rust-version = "1.76.0"
 autotests = false
 
 [[test]]
@@ -61,9 +61,9 @@ zip = { version = "1.1.1", default-features = false, features = ["deflate"] }
 walkdir = "2.3.2"
 regex = "1.5.5"
 once_cell = "1.12.0"
-deno_runtime = { version = "0.134.0" }
-deno_core = { version = "0.232.0" }
-deno_ast = { version = "0.31.2", features = ["transpiling"] }
+deno_runtime = { version = "0.159.0" }
+deno_core = { version = "0.280.0" }
+deno_ast = { version = "0.38.1", features = ["transpiling"] }
 birdcage = { version = "0.8.1" }
 libc = "0.2.135"
 ignore = { version = "0.4.20", optional = true }

cli/js/api.js

@@ -0,0 +1,167 @@
+/*
+ * The functions in this file are documented in `extensions/phylum.d.ts`.
+ */
+
+import {
+  analyze as op_analyze,
+  api_base_url,
+  check_packages,
+  check_packages_raw,
+  create_project,
+  delete_project,
+  get_access_token,
+  get_current_project,
+  get_groups,
+  get_job_status,
+  get_package_details,
+  get_projects,
+  get_refresh_token,
+  get_user_info,
+  op_permissions,
+  parse_depfile,
+  run_sandboxed,
+} from "ext:core/ops";
+
+async function ensureRequestHeaders(init) {
+  const headers = init.headers = new Headers(init.headers);
+
+  // Set Authorization header if it is missing.
+  if (!headers.has("Authorization")) {
+    const token = await getAccessToken();
+    headers.set("Authorization", `Bearer ${token}`);
+  }
+
+  // Set Content-Type header if it is missing.
+  if (init.body && !headers.has("Content-Type")) {
+    headers.set("Content-Type", "application/json");
+  }
+}
+
+export async function fetch(
+  apiVersion,
+  endpoint,
+  init,
+) {
+  // Ensure header object is initialized.
+  const fetchInit = init ?? {};
+
+  await ensureRequestHeaders(fetchInit);
+
+  // Get API base URI without version.
+  const baseUrl = await apiBaseUrl();
+
+  // Send fetch request.
+  return globalThis.fetch(`${baseUrl}/${apiVersion}${endpoint}`, fetchInit);
+}
+
+export async function apiBaseUrl() {
+  return new URL(await api_base_url());
+}
+
+export function analyze(
+  packages,
+  project,
+  group,
+  label,
+) {
+  return op_analyze(
+    packages,
+    project,
+    group,
+    label,
+  );
+}
+
+export function checkPackagesRaw(
+  packages,
+) {
+  return check_packages_raw(packages);
+}
+
+export function checkPackages(packages) {
+  return check_packages(packages);
+}
+
+export function getUserInfo() {
+  return get_user_info();
+}
+
+export function getAccessToken() {
+  return get_access_token();
+}
+
+export function getRefreshToken() {
+  return get_refresh_token();
+}
+
+export function getJobStatus(
+  jobId,
+  ignoredPackages,
+) {
+  return get_job_status(jobId, ignoredPackages);
+}
+
+export function getJobStatusRaw(
+  jobId,
+  ignoredPackages,
+) {
+  return get_job_status(jobId, ignoredPackages);
+}
+
+export function getCurrentProject() {
+  return get_current_project();
+}
+
+export function getGroups() {
+  return get_groups();
+}
+
+export function getProjects(group) {
+  return get_projects(group);
+}
+
+export function createProject(
+  name,
+  group,
+  repository_url,
+) {
+  return create_project(name, group, repository_url);
+}
+
+export function deleteProject(name, group) {
+  return delete_project(name, group);
+}
+
+export function getPackageDetails(
+  name,
+  version,
+  packageType,
+) {
+  return get_package_details(
+    name,
+    version,
+    packageType,
+  );
+}
+
+export function parseDependencyFile(
+  depfile,
+  depfileType,
+  generateLockfiles,
+  sandboxGeneration,
+) {
+  return parse_depfile(
+    depfile,
+    depfileType,
+    generateLockfiles,
+    sandboxGeneration,
+  );
+}
+
+export function runSandboxed(process) {
+  return run_sandboxed(process);
+}
+
+export function permissions() {
+  return op_permissions();
+}

cli/js/api_version.js

@@ -0,0 +1,8 @@
+/*
+ * Available Phylum REST API versions.
+ *
+ * NOTE: This must match the type in `extensions/phylum.d.ts`.
+ */
+export const ApiVersion = {
+  V0: "v0",
+};

cli/js/main.js

@@ -0,0 +1,6 @@
+import * as Api from "ext:phylum_api/api.js";
+import { ApiVersion } from "ext:phylum_api/api_version.js";
+
+globalThis.Phylum ??= {};
+Object.assign(globalThis.Phylum, Api);
+globalThis.Phylum.ApiVersion = ApiVersion;

cli/src/commands/extensions/api.rs

@@ -14,7 +14,7 @@ use std::rc::Rc;
 use std::str::FromStr;
 
 use anyhow::{anyhow, Error, Result};
-use deno_runtime::deno_core::{op2, Op, OpDecl, OpState};
+use deno_runtime::deno_core::{op2, OpDecl, OpState};
 use deno_runtime::permissions::PermissionsContainer;
 use phylum_lockfile::ParsedLockfile;
 use phylum_project::ProjectConfig;
@@ -32,6 +32,7 @@ use crate::commands::extensions::state::ExtensionState;
 use crate::commands::parse;
 #[cfg(unix)]
 use crate::commands::ExitCode;
+use crate::config::Config;
 #[cfg(unix)]
 use crate::dirs;
 use crate::types::{
@@ -225,6 +226,15 @@ async fn get_user_info(op_state: Rc<RefCell<OpState>>) -> Result<UserInfo> {
     api.user_info().await.map_err(Error::from)
 }
 
+/// Retrieve the refresh token.
+async fn refresh_token(config: &Config) -> Result<RefreshToken> {
+    config
+        .auth_info
+        .offline_access()
+        .cloned()
+        .ok_or_else(|| anyhow!("User is not currently authenticated"))
+}
+
 /// Retrieve the access token.
 /// Equivalent to `phylum auth token --bearer`.
 #[op2(async)]
@@ -233,12 +243,12 @@ async fn get_access_token(
     op_state: Rc<RefCell<OpState>>,
     ignore_certs: bool,
 ) -> Result<AccessToken> {
-    let refresh_token = get_refresh_token::call(op_state.clone()).await?;
-
     let state = ExtensionState::from(op_state);
     let api = state.api().await?;
     let config = api.config();
 
+    let refresh_token = refresh_token(config).await?;
+
     let access_token =
         crate::auth::renew_access_token(&refresh_token, ignore_certs, &config.connection.uri)
             .await?;
@@ -255,11 +265,7 @@ async fn get_refresh_token(op_state: Rc<RefCell<OpState>>) -> Result<RefreshToke
     let api = state.api().await?;
     let config = api.config();
 
-    config
-        .auth_info
-        .offline_access()
-        .cloned()
-        .ok_or_else(|| anyhow!("User is not currently authenticated"))
+    refresh_token(config).await
 }
 
 /// Retrieve a job's status.
@@ -576,23 +582,23 @@ async fn api_base_url(op_state: Rc<RefCell<OpState>>) -> Result<String> {
 
 pub(crate) fn api_decls() -> Vec<OpDecl> {
     vec![
-        analyze::DECL,
-        api_base_url::DECL,
-        check_packages::DECL,
-        check_packages_raw::DECL,
-        create_project::DECL,
-        delete_project::DECL,
-        get_access_token::DECL,
-        get_current_project::DECL,
-        get_groups::DECL,
-        get_job_status::DECL,
-        get_job_status_raw::DECL,
-        get_package_details::DECL,
-        get_projects::DECL,
-        get_refresh_token::DECL,
-        get_user_info::DECL,
-        op_permissions::DECL,
-        parse_depfile::DECL,
-        run_sandboxed::DECL,
+        analyze(),
+        api_base_url(),
+        check_packages(),
+        check_packages_raw(),
+        create_project(),
+        delete_project(),
+        get_access_token(),
+        get_current_project(),
+        get_groups(),
+        get_job_status(),
+        get_job_status_raw(),
+        get_package_details(),
+        get_projects(),
+        get_refresh_token(),
+        get_user_info(),
+        op_permissions(),
+        parse_depfile(),
+        run_sandboxed(),
     ]
 }

cli/src/commands/extensions/mod.rs

@@ -26,8 +26,6 @@ pub mod permissions;
 pub mod state;
 
 const EXTENSION_SKELETON: &[u8] = b"\
-import { PhylumApi } from 'phylum';
-
 console.log('Hello, World!');
 ";
 

cli/src/commands/extensions/permissions.rs

@@ -269,6 +269,7 @@ impl From<&Permissions> for PermissionsOptions {
         let allow_net = allow_net.get().cloned();
 
         PermissionsOptions {
+            allow_all: false,
             allow_read,
             allow_write,
             allow_run,