@aderis-erp/cli 1.0.15 → 1.0.17

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aderis-erp/cli",
   "description": "Aderis Live Finance Platform CLI - Manage your Aderis account from the command line",
-  "version": "1.0.15",
+  "version": "1.0.17",
   "author": "Aderis AG",
   "publishConfig": {
     "access": "public"
@@ -38,6 +38,7 @@
     "eslint-config-oclif": "^6",
     "eslint-config-prettier": "^10",
     "mocha": "^11.7.6",
+    "nock": "^14.0.17",
     "oclif": "^4.23.27",
     "shx": "^0.4.0",
     "ts-node": "^10",

package/dist/lib/auth.d.ts

@@ -1,43 +0,0 @@
-import { type Context, type TokenData } from './config.js';
-export declare function login(context: Context, options?: {
-    prompt?: 'login' | 'none';
-}): Promise<TokenData>;
-export declare function refreshTokens(contextName: string): Promise<TokenData>;
-export declare function getValidToken(contextName: string): Promise<string>;
-/**
- * Build the auth headers for a context: a bearer token for `oauth2` contexts
- * (refreshing it first if needed) or `x-api-key` for `api_key` contexts.
- *
- * This is the single place that decides how credentials reach the API — callers
- * should never read `tokens` or `api_key` off a context to build headers.
- */
-export declare function getAuthHeaders(contextName: string): Promise<Record<string, string>>;
-export declare function testAuth(contextName: string): Promise<{
-    email: string;
-    name?: string;
-}>;
-export interface Tenant {
-    createdAt?: string;
-    isDefault?: boolean;
-    name: string;
-    tenantId: string;
-}
-export declare function listTenants(contextName: string): Promise<Tenant[]>;
-export declare function getCurrentTenant(contextName: string): Promise<null | {
-    name?: string;
-    tenantId: string;
-}>;
-export declare function switchTenant(contextName: string, tenantId: string): Promise<TokenData>;
-/**
- * Combined login + tenant switch flow that uses a single browser tab.
- *
- * Two PKCE rounds run against one local callback server. After the first round
- * completes (which gives us tokens we can use to PUT the new active tenant),
- * the server responds with HTML that meta-refreshes the same browser tab to a
- * second `/oauth/authorize` URL. The second round mints tokens scoped to the
- * new active tenant.
- *
- * Used by `aderis switch` when the user's session is expired AND they want to
- * end up on a different tenant — avoids the previous two-separate-tab UX.
- */
-export declare function loginAndSwitchTenant(context: Context, tenantId: string): Promise<TokenData>;

package/dist/lib/auth.js

@@ -1,610 +0,0 @@
-import axios from 'axios';
-import jwt from 'jsonwebtoken';
-import * as crypto from 'node:crypto';
-import * as http from 'node:http';
-import { URL, URLSearchParams } from 'node:url';
-import open from 'open';
-import { getAuthType, getBaseUrls, getContext, missingCredentialsMessage, saveCachedTenants, saveTokens, } from './config.js';
-function buildValidatedUrl(baseUrl, path) {
-    try {
-        // Minimal path validation
-        if (baseUrl.includes('/../') || /\/%2e%2e\//i.test(baseUrl)) {
-            throw new Error('Invalid path');
-        }
-        const url = new URL(baseUrl);
-        // Protocol + host checks
-        const allowedDomains = [
-            'api.aderis.com', 'api-staging.aderis.com', 'api-dev.aderis.com',
-            'auth.aderis.com', 'auth-staging.aderis.com', 'auth-dev.aderis.com',
-            'localhost',
-        ];
-        if (!allowedDomains.includes(url.hostname)) {
-            throw new Error(`Invalid host: ${url.hostname}`);
-        }
-        if (!['http:', 'https:'].includes(url.protocol)) {
-            throw new Error('Invalid protocol');
-        }
-        // Add path if provided
-        if (path) {
-            if (path.includes('/../') || /\/%2e%2e\//i.test(path)) {
-                throw new Error('Invalid path');
-            }
-            // Ensure path starts with / and append to pathname
-            const cleanPath = path.startsWith('/') ? path : '/' + path;
-            url.pathname = url.pathname.replace(/\/$/, '') + cleanPath;
-        }
-        return url.href;
-    }
-    catch {
-        throw new Error('Invalid URL');
-    }
-}
-const CALLBACK_PORT = 8085;
-const REDIRECT_URI = `http://localhost:${CALLBACK_PORT}/oauth/callback`;
-const ADERIS_LOGO_URL = 'https://public.aderis.com/69da47c9-274a-4103-bc3e-d9123fd13fac.png';
-const ADERIS_ACCENT_COLOR = '#9687f5';
-function renderAuthPage(type, title, message) {
-    const isSuccess = type === 'success';
-    const iconColor = isSuccess ? ADERIS_ACCENT_COLOR : '#dc2626';
-    const icon = isSuccess
-        ? `<svg width="64" height="64" viewBox="0 0 24 24" fill="none" stroke="${iconColor}" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><path d="m9 12 2 2 4-4"/></svg>`
-        : `<svg width="64" height="64" viewBox="0 0 24 24" fill="none" stroke="${iconColor}" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><line x1="15" y1="9" x2="9" y2="15"/><line x1="9" y1="9" x2="15" y2="15"/></svg>`;
-    return `<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="UTF-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>${title} - Aderis CLI</title>
-  <style>
-    * {
-      margin: 0;
-      padding: 0;
-      box-sizing: border-box;
-    }
-    body {
-      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
-      min-height: 100vh;
-      display: flex;
-      align-items: center;
-      justify-content: center;
-      background: linear-gradient(135deg, #f8f7ff 0%, #f0eeff 100%);
-      padding: 20px;
-    }
-    .container {
-      background: white;
-      border-radius: 16px;
-      box-shadow: 0 4px 24px rgba(150, 135, 245, 0.15);
-      padding: 48px;
-      text-align: center;
-      max-width: 440px;
-      width: 100%;
-    }
-    .logo {
-      margin-bottom: 32px;
-    }
-    .logo img {
-      height: 40px;
-      width: auto;
-    }
-    .icon {
-      margin-bottom: 24px;
-    }
-    h1 {
-      font-size: 24px;
-      font-weight: 600;
-      color: #1a1a2e;
-      margin-bottom: 12px;
-    }
-    .message {
-      font-size: 16px;
-      color: #6b7280;
-      line-height: 1.6;
-      margin-bottom: 8px;
-    }
-    .message strong {
-      color: #1a1a2e;
-    }
-    .hint {
-      font-size: 14px;
-      color: #9ca3af;
-      margin-top: 24px;
-    }
-    .divider {
-      height: 1px;
-      background: linear-gradient(90deg, transparent, #e5e7eb, transparent);
-      margin: 24px 0;
-    }
-  </style>
-</head>
-<body>
-  <div class="container">
-    <div class="logo">
-      <img src="${ADERIS_LOGO_URL}" alt="Aderis" />
-    </div>
-    <div class="icon">
-      ${icon}
-    </div>
-    <h1>${title}</h1>
-    <p class="message">${message}</p>
-    <div class="divider"></div>
-    <p class="hint">You can close this window and return to the CLI.</p>
-  </div>
-</body>
-</html>`;
-}
-/**
- * Guard for flows that only exist for OAuth contexts (browser login, token
- * refresh, Frontegg tenant switching). API keys are issued per tenant, so there
- * is nothing to log into or switch.
- */
-function requireOAuthContext(context, action) {
-    if (getAuthType(context) === 'api_key') {
-        throw new Error(`${action} requires OAuth. Context "${context.name}" authenticates with an API key, which is already scoped to one tenant.`);
-    }
-}
-/** `client_id` is optional on Context (API-key contexts have none), so OAuth flows must assert it. */
-function requireClientId(context) {
-    if (!context.client_id) {
-        throw new Error(`Context "${context.name}" has no OAuth client ID. Recreate it with: aderis config add`);
-    }
-    return context.client_id;
-}
-function generatePKCE() {
-    const verifier = crypto.randomBytes(32).toString('base64url');
-    const challenge = crypto.createHash('sha256').update(verifier).digest('base64url');
-    return { challenge, verifier };
-}
-function generateState() {
-    return crypto.randomBytes(16).toString('hex');
-}
-function buildAuthorizeUrl(context, pkce, state, options = {}) {
-    const { auth: authUrl } = getBaseUrls(context.environment);
-    const url = new URL(`${authUrl}/oauth/authorize`);
-    url.searchParams.set('client_id', requireClientId(context));
-    url.searchParams.set('redirect_uri', REDIRECT_URI);
-    url.searchParams.set('response_type', 'code');
-    url.searchParams.set('state', state);
-    url.searchParams.set('code_challenge', pkce.challenge);
-    url.searchParams.set('code_challenge_method', 'S256');
-    url.searchParams.set('scope', 'openid profile email offline_access');
-    if (options.prompt)
-        url.searchParams.set('prompt', options.prompt);
-    return url.toString();
-}
-export async function login(context, options = {}) {
-    requireOAuthContext(context, 'Browser login');
-    const pkce = generatePKCE();
-    const state = generateState();
-    const authorizationUrl = buildAuthorizeUrl(context, pkce, state, options);
-    return new Promise((resolve, reject) => {
-        const connections = new Set();
-        // eslint-disable-next-line prefer-const -- assigned after server creation; closure captures the reference safely
-        let timeoutId;
-        const server = http.createServer(async (req, res) => {
-            const url = new URL(req.url || '', `http://localhost:${CALLBACK_PORT}`);
-            if (url.pathname !== '/oauth/callback') {
-                res.writeHead(404);
-                res.end('Not Found');
-                return;
-            }
-            const code = url.searchParams.get('code');
-            const returnedState = url.searchParams.get('state');
-            const error = url.searchParams.get('error');
-            const errorDescription = url.searchParams.get('error_description');
-            if (error) {
-                res.writeHead(400, { 'Content-Type': 'text/html' });
-                res.end(renderAuthPage('error', 'Authentication Failed', errorDescription || error));
-                closeServer();
-                reject(new Error(errorDescription || error));
-                return;
-            }
-            if (!code || returnedState !== state) {
-                res.writeHead(400, { 'Content-Type': 'text/html' });
-                res.end(renderAuthPage('error', 'Authentication Failed', 'Invalid response from authorization server.'));
-                closeServer();
-                reject(new Error('Invalid authorization response'));
-                return;
-            }
-            try {
-                // Exchange code for tokens
-                const tokens = await exchangeCodeForTokens(context, code, pkce.verifier);
-                res.writeHead(200, { Connection: 'close', 'Content-Type': 'text/html' });
-                res.end(renderAuthPage('success', 'Authentication Successful', `You have been logged in to <strong>${context.name}</strong> (${context.environment}).`));
-                // Save tokens immediately
-                saveTokens(context.name, tokens);
-                // Use setImmediate to let the response flush, then close
-                setImmediate(() => {
-                    closeServer();
-                    resolve(tokens);
-                });
-            }
-            catch (error_) {
-                res.writeHead(500, { 'Content-Type': 'text/html' });
-                res.end(renderAuthPage('error', 'Authentication Failed', error_ instanceof Error ? error_.message : 'Unknown error'));
-                closeServer();
-                reject(error_);
-            }
-        });
-        // Track connections so we can force-close them
-        server.on('connection', (socket) => {
-            connections.add(socket);
-            socket.on('close', () => connections.delete(socket));
-        });
-        const closeServer = () => {
-            // Clear the timeout to allow process to exit
-            clearTimeout(timeoutId);
-            // Destroy all open connections
-            for (const socket of connections) {
-                socket.destroy();
-            }
-            connections.clear();
-            server.close();
-            process.off('SIGINT', onSigint);
-        };
-        const onSigint = () => {
-            closeServer();
-            // Exit with the standard SIGINT code so the parent shell sees the
-            // expected termination status instead of a hung process. This is a CLI;
-            // process.exit is the correct way to bail from a SIGINT.
-            // eslint-disable-next-line unicorn/no-process-exit, n/no-process-exit
-            process.exit(130);
-        };
-        process.once('SIGINT', onSigint);
-        server.listen(CALLBACK_PORT, () => {
-            console.log(`Opening browser for authentication...`);
-            console.log(`If the browser doesn't open, visit: ${authorizationUrl}`);
-            open(authorizationUrl);
-        });
-        server.on('error', (err) => {
-            closeServer();
-            reject(new Error(`Failed to start local server: ${err.message}`));
-        });
-        // Timeout after 5 minutes
-        timeoutId = setTimeout(() => {
-            closeServer();
-            reject(new Error('Authentication timed out'));
-        }, 5 * 60 * 1000);
-    });
-}
-async function exchangeCodeForTokens(context, code, codeVerifier) {
-    const { auth: authUrl } = getBaseUrls(context.environment);
-    const params = new URLSearchParams();
-    params.set('grant_type', 'authorization_code');
-    params.set('client_id', requireClientId(context));
-    params.set('code', code);
-    params.set('redirect_uri', REDIRECT_URI);
-    params.set('code_verifier', codeVerifier);
-    if (context.client_secret) {
-        params.set('client_secret', context.client_secret);
-    }
-    const response = await axios.post(buildValidatedUrl(authUrl, '/oauth/token'), params.toString(), {
-        headers: {
-            Accept: 'application/json',
-            'Content-Type': 'application/x-www-form-urlencoded',
-        },
-    });
-    const tokens = response.data;
-    const decoded = jwt.decode(tokens.access_token);
-    return {
-        access_token: tokens.access_token,
-        expires_at: tokens.expires_in ? Date.now() + tokens.expires_in * 1000 : undefined,
-        refresh_token: tokens.refresh_token,
-        tenant_id: decoded?.tenantId || decoded?.tenant_id,
-    };
-}
-export async function refreshTokens(contextName) {
-    const context = getContext(contextName);
-    if (!context) {
-        throw new Error(`Context "${contextName}" not found`);
-    }
-    requireOAuthContext(context, 'Token refresh');
-    if (!context.tokens?.refresh_token) {
-        throw new Error('No refresh token available. Please login again.');
-    }
-    const { auth: authUrl } = getBaseUrls(context.environment);
-    const params = new URLSearchParams();
-    params.set('grant_type', 'refresh_token');
-    params.set('client_id', requireClientId(context));
-    params.set('refresh_token', context.tokens.refresh_token);
-    if (context.client_secret) {
-        params.set('client_secret', context.client_secret);
-    }
-    let response;
-    try {
-        response = await axios.post(buildValidatedUrl(authUrl, '/oauth/token'), params.toString(), {
-            headers: {
-                Accept: 'application/json',
-                'Content-Type': 'application/x-www-form-urlencoded',
-            },
-        });
-    }
-    catch (error) {
-        if (axios.isAxiosError(error) && (error.response?.status === 401 || error.response?.status === 400)) {
-            throw new Error('Session expired. Please run: aderis auth login');
-        }
-        throw error;
-    }
-    const tokens = response.data;
-    const decoded = jwt.decode(tokens.access_token);
-    const tokenData = {
-        access_token: tokens.access_token,
-        expires_at: tokens.expires_in ? Date.now() + tokens.expires_in * 1000 : undefined,
-        refresh_token: tokens.refresh_token || context.tokens.refresh_token,
-        tenant_id: decoded?.tenantId || decoded?.tenant_id,
-    };
-    saveTokens(contextName, tokenData);
-    return tokenData;
-}
-export async function getValidToken(contextName) {
-    const context = getContext(contextName);
-    if (!context) {
-        throw new Error(`Context "${contextName}" not found`);
-    }
-    if (getAuthType(context) === 'api_key') {
-        throw new Error(`Context "${contextName}" authenticates with an API key and has no access token. Use getAuthHeaders() instead.`);
-    }
-    if (!context.tokens?.access_token) {
-        throw new Error('Not logged in. Please run: aderis auth login');
-    }
-    // Check if token is expired (with 60 second buffer)
-    if (context.tokens.expires_at && context.tokens.expires_at < Date.now() + 60_000) {
-        if (context.tokens.refresh_token) {
-            const newTokens = await refreshTokens(contextName);
-            return newTokens.access_token;
-        }
-        throw new Error('Token expired. Please run: aderis auth login');
-    }
-    return context.tokens.access_token;
-}
-/**
- * Build the auth headers for a context: a bearer token for `oauth2` contexts
- * (refreshing it first if needed) or `x-api-key` for `api_key` contexts.
- *
- * This is the single place that decides how credentials reach the API — callers
- * should never read `tokens` or `api_key` off a context to build headers.
- */
-export async function getAuthHeaders(contextName) {
-    const context = getContext(contextName);
-    if (!context) {
-        throw new Error(`Context "${contextName}" not found`);
-    }
-    if (getAuthType(context) === 'api_key') {
-        if (!context.api_key) {
-            throw new Error(missingCredentialsMessage(context));
-        }
-        return { 'x-api-key': context.api_key };
-    }
-    return { Authorization: `Bearer ${await getValidToken(contextName)}` };
-}
-export async function testAuth(contextName) {
-    const context = getContext(contextName);
-    if (!context) {
-        throw new Error(`Context "${contextName}" not found`);
-    }
-    const { api: apiUrl } = getBaseUrls(context.environment);
-    const response = await axios.get(buildValidatedUrl(apiUrl, '/v1/auth/me'), {
-        headers: {
-            Accept: 'application/json',
-            ...(await getAuthHeaders(contextName)),
-        },
-    });
-    return response.data;
-}
-export async function listTenants(contextName) {
-    const context = getContext(contextName);
-    if (!context) {
-        throw new Error(`Context "${contextName}" not found`);
-    }
-    requireOAuthContext(context, 'Listing tenants');
-    const token = await getValidToken(contextName);
-    const { auth: authUrl } = getBaseUrls(context.environment);
-    let response;
-    try {
-        // Frontegg endpoint to list user's tenants
-        response = await axios.get(buildValidatedUrl(authUrl, '/identity/resources/users/v2/me/tenants'), {
-            headers: {
-                Accept: 'application/json',
-                Authorization: `Bearer ${token}`,
-            },
-        });
-    }
-    catch (error) {
-        if (axios.isAxiosError(error) && error.response?.status === 401) {
-            throw new Error('Session expired. Please run: aderis auth login');
-        }
-        throw error;
-    }
-    // Normalize the response - Frontegg may use different field names
-    const tenants = response.data.map((t) => ({
-        createdAt: t.createdAt,
-        isDefault: t.isDefault,
-        name: t.name || t.tenantName || t.tenantId,
-        tenantId: t.tenantId,
-    }));
-    // Cache for use when the access token is expired (e.g. session-expired branch
-    // of `aderis switch`, where we want to show the picker before re-authenticating).
-    saveCachedTenants(contextName, tenants.map((t) => ({ name: t.name, tenantId: t.tenantId })));
-    return tenants;
-}
-export async function getCurrentTenant(contextName) {
-    const context = getContext(contextName);
-    if (!context) {
-        throw new Error(`Context "${contextName}" not found`);
-    }
-    // API-key contexts carry no JWT, so there is no tenant to decode locally.
-    if (getAuthType(context) === 'api_key' || !context.tokens?.access_token) {
-        return null;
-    }
-    const decoded = jwt.decode(context.tokens.access_token);
-    const tenantId = decoded?.tenantId || decoded?.tenant_id;
-    if (!tenantId) {
-        return null;
-    }
-    // Try to get tenant name from the list
-    try {
-        const tenants = await listTenants(contextName);
-        const tenant = tenants.find((t) => t.tenantId === tenantId);
-        return {
-            name: tenant?.name,
-            tenantId,
-        };
-    }
-    catch {
-        return { tenantId };
-    }
-}
-export async function switchTenant(contextName, tenantId) {
-    const context = getContext(contextName);
-    if (!context) {
-        throw new Error(`Context "${contextName}" not found`);
-    }
-    requireOAuthContext(context, 'Switching tenants');
-    if (!context.tokens?.refresh_token) {
-        throw new Error('No refresh token available. Please login again.');
-    }
-    try {
-        // Delegate to the two-round PKCE flow. Round 1 issues a token for whatever
-        // tenant Frontegg's session cookie currently holds (which forces Frontegg
-        // to refresh its session state), then we PUT the requested tenant, and
-        // round 2 — reached via meta-refresh on the same browser tab — issues a
-        // token scoped to the new tenant. No re-authentication is required because
-        // the user's Frontegg session cookie is still valid.
-        return await loginAndSwitchTenant(context, tenantId);
-    }
-    catch (error) {
-        if (axios.isAxiosError(error) && (error.response?.status === 401 || error.response?.status === 400)) {
-            throw new Error('Session expired. Please run: aderis auth login');
-        }
-        throw error;
-    }
-}
-/**
- * Combined login + tenant switch flow that uses a single browser tab.
- *
- * Two PKCE rounds run against one local callback server. After the first round
- * completes (which gives us tokens we can use to PUT the new active tenant),
- * the server responds with HTML that meta-refreshes the same browser tab to a
- * second `/oauth/authorize` URL. The second round mints tokens scoped to the
- * new active tenant.
- *
- * Used by `aderis switch` when the user's session is expired AND they want to
- * end up on a different tenant — avoids the previous two-separate-tab UX.
- */
-export async function loginAndSwitchTenant(context, tenantId) {
-    const { auth: authUrl } = getBaseUrls(context.environment);
-    const pkce1 = generatePKCE();
-    const state1 = generateState();
-    const pkce2 = generatePKCE();
-    const state2 = generateState();
-    const authorizeUrl1 = buildAuthorizeUrl(context, pkce1, state1);
-    const authorizeUrl2 = buildAuthorizeUrl(context, pkce2, state2);
-    return new Promise((resolve, reject) => {
-        const connections = new Set();
-        const timeoutRef = {};
-        const closeServer = () => {
-            if (timeoutRef.id)
-                clearTimeout(timeoutRef.id);
-            for (const socket of connections) {
-                socket.destroy();
-            }
-            connections.clear();
-            server.close();
-            process.off('SIGINT', onSigint);
-        };
-        const onSigint = () => {
-            closeServer();
-            // eslint-disable-next-line unicorn/no-process-exit, n/no-process-exit
-            process.exit(130);
-        };
-        process.once('SIGINT', onSigint);
-        const server = http.createServer(async (req, res) => {
-            const url = new URL(req.url || '', `http://localhost:${CALLBACK_PORT}`);
-            if (url.pathname !== '/oauth/callback') {
-                res.writeHead(404);
-                res.end('Not Found');
-                return;
-            }
-            const code = url.searchParams.get('code');
-            const returnedState = url.searchParams.get('state');
-            const error = url.searchParams.get('error');
-            const errorDescription = url.searchParams.get('error_description');
-            if (error || !code || !returnedState) {
-                res.writeHead(400, { 'Content-Type': 'text/html' });
-                res.end(renderAuthPage('error', 'Authentication Failed', errorDescription || error || 'Invalid response'));
-                closeServer();
-                reject(new Error(errorDescription || error || 'Invalid authorization response'));
-                return;
-            }
-            try {
-                if (returnedState === state1) {
-                    // Round 1: fresh login → tokens for whatever tenant Frontegg considers
-                    // active for this user. PUT to set the requested tenant, then redirect
-                    // the SAME browser tab to authorize URL #2 so Frontegg re-mints tokens.
-                    const tokens1 = await exchangeCodeForTokens(context, code, pkce1.verifier);
-                    saveTokens(context.name, tokens1);
-                    await axios.put(buildValidatedUrl(authUrl, '/identity/resources/users/v1/tenant'), { tenantId }, {
-                        headers: {
-                            Accept: 'application/json',
-                            Authorization: `Bearer ${tokens1.access_token}`,
-                            'Content-Type': 'application/json',
-                        },
-                    });
-                    res.writeHead(200, { 'Content-Type': 'text/html' });
-                    res.end(`<!DOCTYPE html>
-<html><head>
-<meta charset="UTF-8">
-<meta http-equiv="refresh" content="0; url=${authorizeUrl2}">
-<title>Switching tenant…</title>
-</head><body><p>Switching tenant…</p></body></html>`);
-                    return;
-                }
-                if (returnedState === state2) {
-                    // Round 2: tokens scoped to the new tenant.
-                    const tokens2 = await exchangeCodeForTokens(context, code, pkce2.verifier);
-                    saveTokens(context.name, tokens2);
-                    if (tokens2.tenant_id !== tenantId) {
-                        res.writeHead(400, { 'Content-Type': 'text/html' });
-                        res.end(renderAuthPage('error', 'Tenant Switch Failed', `Frontegg returned a token for tenant ${tokens2.tenant_id} instead of ${tenantId}.`));
-                        closeServer();
-                        reject(new Error(`Tenant switch did not propagate. Frontegg returned tenant ${tokens2.tenant_id} instead of ${tenantId}. Please try again in a few seconds.`));
-                        return;
-                    }
-                    res.writeHead(200, { Connection: 'close', 'Content-Type': 'text/html' });
-                    res.end(renderAuthPage('success', 'Tenant Switched', `You have been logged in to <strong>${context.name}</strong> on the selected tenant.`));
-                    setImmediate(() => {
-                        closeServer();
-                        resolve(tokens2);
-                    });
-                    return;
-                }
-                res.writeHead(400, { 'Content-Type': 'text/html' });
-                res.end(renderAuthPage('error', 'Authentication Failed', 'Invalid state parameter.'));
-                closeServer();
-                reject(new Error('Invalid state in callback'));
-            }
-            catch (error_) {
-                res.writeHead(500, { 'Content-Type': 'text/html' });
-                res.end(renderAuthPage('error', 'Authentication Failed', error_ instanceof Error ? error_.message : 'Unknown error'));
-                closeServer();
-                reject(error_);
-            }
-        });
-        server.on('connection', (socket) => {
-            connections.add(socket);
-            socket.on('close', () => connections.delete(socket));
-        });
-        server.listen(CALLBACK_PORT, () => {
-            console.log('Opening browser for authentication…');
-            console.log(`If the browser doesn't open, visit: ${authorizeUrl1}`);
-            open(authorizeUrl1);
-        });
-        server.on('error', (err) => {
-            closeServer();
-            reject(new Error(`Failed to start local server: ${err.message}`));
-        });
-        timeoutRef.id = setTimeout(() => {
-            closeServer();
-            reject(new Error('Authentication timed out'));
-        }, 5 * 60 * 1000);
-    });
-}