@aderis-erp/cli 1.0.2 → 1.0.4

package/dist/lib/auth.js

@@ -4,7 +4,7 @@ import * as crypto from 'node:crypto';
 import * as http from 'node:http';
 import { URL, URLSearchParams } from 'node:url';
 import open from 'open';
-import { getBaseUrls, getContext, saveTokens } from './config.js';
+import { getBaseUrls, getContext, saveCachedTenants, saveTokens, } from './config.js';
 function buildValidatedUrl(baseUrl, path) {
     try {
         // Minimal path validation
@@ -140,19 +140,24 @@ function generatePKCE() {
 function generateState() {
     return crypto.randomBytes(16).toString('hex');
 }
-export async function login(context) {
+function buildAuthorizeUrl(context, pkce, state, options = {}) {
     const { auth: authUrl } = getBaseUrls(context.environment);
+    const url = new URL(`${authUrl}/oauth/authorize`);
+    url.searchParams.set('client_id', context.client_id);
+    url.searchParams.set('redirect_uri', REDIRECT_URI);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('state', state);
+    url.searchParams.set('code_challenge', pkce.challenge);
+    url.searchParams.set('code_challenge_method', 'S256');
+    url.searchParams.set('scope', 'openid profile email offline_access');
+    if (options.prompt)
+        url.searchParams.set('prompt', options.prompt);
+    return url.toString();
+}
+export async function login(context, options = {}) {
     const pkce = generatePKCE();
     const state = generateState();
-    // Build authorization URL
-    const authorizationUrl = new URL(`${authUrl}/oauth/authorize`);
-    authorizationUrl.searchParams.set('client_id', context.client_id);
-    authorizationUrl.searchParams.set('redirect_uri', REDIRECT_URI);
-    authorizationUrl.searchParams.set('response_type', 'code');
-    authorizationUrl.searchParams.set('state', state);
-    authorizationUrl.searchParams.set('code_challenge', pkce.challenge);
-    authorizationUrl.searchParams.set('code_challenge_method', 'S256');
-    authorizationUrl.searchParams.set('scope', 'openid profile email offline_access');
+    const authorizationUrl = buildAuthorizeUrl(context, pkce, state, options);
     return new Promise((resolve, reject) => {
         const connections = new Set();
         let timeoutId;
@@ -215,11 +220,21 @@ export async function login(context) {
             }
             connections.clear();
             server.close();
+            process.off('SIGINT', onSigint);
+        };
+        const onSigint = () => {
+            closeServer();
+            // Exit with the standard SIGINT code so the parent shell sees the
+            // expected termination status instead of a hung process. This is a CLI;
+            // process.exit is the correct way to bail from a SIGINT.
+            // eslint-disable-next-line unicorn/no-process-exit, n/no-process-exit
+            process.exit(130);
         };
+        process.once('SIGINT', onSigint);
         server.listen(CALLBACK_PORT, () => {
             console.log(`Opening browser for authentication...`);
-            console.log(`If the browser doesn't open, visit: ${authorizationUrl.toString()}`);
-            open(authorizationUrl.toString());
+            console.log(`If the browser doesn't open, visit: ${authorizationUrl}`);
+            open(authorizationUrl);
         });
         server.on('error', (err) => {
             closeServer();
@@ -357,12 +372,16 @@ export async function listTenants(contextName) {
         throw error;
     }
     // Normalize the response - Frontegg may use different field names
-    return response.data.map((t) => ({
+    const tenants = response.data.map((t) => ({
         createdAt: t.createdAt,
         isDefault: t.isDefault,
         name: t.name || t.tenantName || t.tenantId,
         tenantId: t.tenantId,
     }));
+    // Cache for use when the access token is expired (e.g. session-expired branch
+    // of `aderis switch`, where we want to show the picker before re-authenticating).
+    saveCachedTenants(contextName, tenants.map((t) => ({ name: t.name, tenantId: t.tenantId })));
+    return tenants;
 }
 export async function getCurrentTenant(contextName) {
     const context = getContext(contextName);
@@ -398,38 +417,14 @@ export async function switchTenant(contextName, tenantId) {
     if (!context.tokens?.refresh_token) {
         throw new Error('No refresh token available. Please login again.');
     }
-    const { auth: authUrl } = getBaseUrls(context.environment);
-    const token = await getValidToken(contextName);
     try {
-        // Step 1: PUT to switch the user's active tenant
-        await axios.put(buildValidatedUrl(authUrl, '/identity/resources/users/v1/tenant'), { tenantId }, {
-            headers: {
-                Accept: 'application/json',
-                Authorization: `Bearer ${token}`,
-                'Content-Type': 'application/json',
-            },
-        });
-        // Step 2: Refresh tokens to get new tokens for the switched tenant
-        const response = await axios.post(buildValidatedUrl(authUrl, '/oauth/token'), new URLSearchParams({
-            client_id: context.client_id,
-            grant_type: 'refresh_token',
-            refresh_token: context.tokens.refresh_token,
-        }).toString(), {
-            headers: {
-                Accept: 'application/json',
-                'Content-Type': 'application/x-www-form-urlencoded',
-            },
-        });
-        const tokens = response.data;
-        const decoded = jwt.decode(tokens.access_token);
-        const tokenData = {
-            access_token: tokens.access_token,
-            expires_at: tokens.expires_in ? Date.now() + tokens.expires_in * 1000 : undefined,
-            refresh_token: tokens.refresh_token || context.tokens.refresh_token,
-            tenant_id: decoded?.tenantId || decoded?.tenant_id,
-        };
-        saveTokens(contextName, tokenData);
-        return tokenData;
+        // Delegate to the two-round PKCE flow. Round 1 issues a token for whatever
+        // tenant Frontegg's session cookie currently holds (which forces Frontegg
+        // to refresh its session state), then we PUT the requested tenant, and
+        // round 2 — reached via meta-refresh on the same browser tab — issues a
+        // token scoped to the new tenant. No re-authentication is required because
+        // the user's Frontegg session cookie is still valid.
+        return await loginAndSwitchTenant(context, tenantId);
     }
     catch (error) {
         if (axios.isAxiosError(error) && (error.response?.status === 401 || error.response?.status === 400)) {
@@ -438,3 +433,133 @@ export async function switchTenant(contextName, tenantId) {
         throw error;
     }
 }
+/**
+ * Combined login + tenant switch flow that uses a single browser tab.
+ *
+ * Two PKCE rounds run against one local callback server. After the first round
+ * completes (which gives us tokens we can use to PUT the new active tenant),
+ * the server responds with HTML that meta-refreshes the same browser tab to a
+ * second `/oauth/authorize` URL. The second round mints tokens scoped to the
+ * new active tenant.
+ *
+ * Used by `aderis switch` when the user's session is expired AND they want to
+ * end up on a different tenant — avoids the previous two-separate-tab UX.
+ */
+export async function loginAndSwitchTenant(context, tenantId) {
+    const { auth: authUrl } = getBaseUrls(context.environment);
+    const pkce1 = generatePKCE();
+    const state1 = generateState();
+    const pkce2 = generatePKCE();
+    const state2 = generateState();
+    const authorizeUrl1 = buildAuthorizeUrl(context, pkce1, state1);
+    const authorizeUrl2 = buildAuthorizeUrl(context, pkce2, state2);
+    return new Promise((resolve, reject) => {
+        const connections = new Set();
+        const timeoutRef = {};
+        const closeServer = () => {
+            if (timeoutRef.id)
+                clearTimeout(timeoutRef.id);
+            for (const socket of connections) {
+                socket.destroy();
+            }
+            connections.clear();
+            server.close();
+            process.off('SIGINT', onSigint);
+        };
+        const onSigint = () => {
+            closeServer();
+            // eslint-disable-next-line unicorn/no-process-exit, n/no-process-exit
+            process.exit(130);
+        };
+        process.once('SIGINT', onSigint);
+        const server = http.createServer(async (req, res) => {
+            const url = new URL(req.url || '', `http://localhost:${CALLBACK_PORT}`);
+            if (url.pathname !== '/oauth/callback') {
+                res.writeHead(404);
+                res.end('Not Found');
+                return;
+            }
+            const code = url.searchParams.get('code');
+            const returnedState = url.searchParams.get('state');
+            const error = url.searchParams.get('error');
+            const errorDescription = url.searchParams.get('error_description');
+            if (error || !code || !returnedState) {
+                res.writeHead(400, { 'Content-Type': 'text/html' });
+                res.end(renderAuthPage('error', 'Authentication Failed', errorDescription || error || 'Invalid response'));
+                closeServer();
+                reject(new Error(errorDescription || error || 'Invalid authorization response'));
+                return;
+            }
+            try {
+                if (returnedState === state1) {
+                    // Round 1: fresh login → tokens for whatever tenant Frontegg considers
+                    // active for this user. PUT to set the requested tenant, then redirect
+                    // the SAME browser tab to authorize URL #2 so Frontegg re-mints tokens.
+                    const tokens1 = await exchangeCodeForTokens(context, code, pkce1.verifier);
+                    saveTokens(context.name, tokens1);
+                    await axios.put(buildValidatedUrl(authUrl, '/identity/resources/users/v1/tenant'), { tenantId }, {
+                        headers: {
+                            Accept: 'application/json',
+                            Authorization: `Bearer ${tokens1.access_token}`,
+                            'Content-Type': 'application/json',
+                        },
+                    });
+                    res.writeHead(200, { 'Content-Type': 'text/html' });
+                    res.end(`<!DOCTYPE html>
+<html><head>
+<meta charset="UTF-8">
+<meta http-equiv="refresh" content="0; url=${authorizeUrl2}">
+<title>Switching tenant…</title>
+</head><body><p>Switching tenant…</p></body></html>`);
+                    return;
+                }
+                if (returnedState === state2) {
+                    // Round 2: tokens scoped to the new tenant.
+                    const tokens2 = await exchangeCodeForTokens(context, code, pkce2.verifier);
+                    saveTokens(context.name, tokens2);
+                    if (tokens2.tenant_id !== tenantId) {
+                        res.writeHead(400, { 'Content-Type': 'text/html' });
+                        res.end(renderAuthPage('error', 'Tenant Switch Failed', `Frontegg returned a token for tenant ${tokens2.tenant_id} instead of ${tenantId}.`));
+                        closeServer();
+                        reject(new Error(`Tenant switch did not propagate. Frontegg returned tenant ${tokens2.tenant_id} instead of ${tenantId}. Please try again in a few seconds.`));
+                        return;
+                    }
+                    res.writeHead(200, { Connection: 'close', 'Content-Type': 'text/html' });
+                    res.end(renderAuthPage('success', 'Tenant Switched', `You have been logged in to <strong>${context.name}</strong> on the selected tenant.`));
+                    setImmediate(() => {
+                        closeServer();
+                        resolve(tokens2);
+                    });
+                    return;
+                }
+                res.writeHead(400, { 'Content-Type': 'text/html' });
+                res.end(renderAuthPage('error', 'Authentication Failed', 'Invalid state parameter.'));
+                closeServer();
+                reject(new Error('Invalid state in callback'));
+            }
+            catch (error_) {
+                res.writeHead(500, { 'Content-Type': 'text/html' });
+                res.end(renderAuthPage('error', 'Authentication Failed', error_ instanceof Error ? error_.message : 'Unknown error'));
+                closeServer();
+                reject(error_);
+            }
+        });
+        server.on('connection', (socket) => {
+            connections.add(socket);
+            socket.on('close', () => connections.delete(socket));
+        });
+        server.listen(CALLBACK_PORT, () => {
+            console.log('Opening browser for authentication…');
+            console.log(`If the browser doesn't open, visit: ${authorizeUrl1}`);
+            open(authorizeUrl1);
+        });
+        server.on('error', (err) => {
+            closeServer();
+            reject(new Error(`Failed to start local server: ${err.message}`));
+        });
+        timeoutRef.id = setTimeout(() => {
+            closeServer();
+            reject(new Error('Authentication timed out'));
+        }, 5 * 60 * 1000);
+    });
+}

package/dist/lib/config.d.ts

@@ -12,7 +12,12 @@ export interface TokenData {
     refresh_token?: string;
     tenant_id?: string;
 }
+export interface CachedTenant {
+    name: string;
+    tenantId: string;
+}
 export interface Context {
+    cachedTenants?: CachedTenant[];
     client_id: string;
     client_secret?: string;
     environment: Environment;
@@ -34,6 +39,8 @@ export declare function addContext(context: Context): void;
 export declare function updateContext(name: string, updates: Partial<Context>): void;
 export declare function deleteContext(name: string): void;
 export declare function saveTokens(contextName: string, tokens: TokenData): void;
+export declare function saveCachedTenants(contextName: string, tenants: CachedTenant[]): void;
+export declare function getCachedTenants(contextName: string): CachedTenant[] | undefined;
 export declare function getTokens(contextName: string): null | TokenData;
 export declare function clearTokens(contextName: string): void;
 export declare function getBaseUrls(environment: Environment): BaseUrls;

package/dist/lib/config.js

@@ -20,7 +20,7 @@ export const BASE_URLS = {
 export const DEFAULT_CLIENT_IDS = {
     dev: '74fd96f8-cf4b-49d8-b713-2a121ea22910',
     live: '970d9568-84c9-4613-b966-30d7e1d93828',
-    test: '', // TODO: Add test client ID
+    test: 'bf0e5dd6-419f-4d64-8951-2c385533651f',
 };
 const CONFIG_DIR = path.join(os.homedir(), '.aderis');
 // Ensure config directory exists
@@ -100,6 +100,12 @@ export function saveTokens(contextName, tokens) {
         tokens,
     });
 }
+export function saveCachedTenants(contextName, tenants) {
+    updateContext(contextName, { cachedTenants: tenants });
+}
+export function getCachedTenants(contextName) {
+    return getContext(contextName)?.cachedTenants;
+}
 export function getTokens(contextName) {
     const context = getContext(contextName);
     return context?.tokens || null;