@amerged/ohmyhost-cli 0.1.10

package/src/apps/product-cli/user-token-file.ts

@@ -0,0 +1,214 @@
+import { constants, lstat, mkdir, open, realpath, type FileHandle } from "node:fs/promises";
+import { basename, dirname, resolve } from "node:path";
+import { execFile } from "node:child_process";
+import { parseEnv, promisify } from "node:util";
+import {
+  parseUserApiKeyCreation,
+  type UserApiKey,
+  type UserApiKeyCreation,
+} from "@ohmyhost/contracts/user-api-keys";
+
+export interface StoredUserApiKey {
+  request_id: string;
+  key: UserApiKey;
+  token_file: string;
+}
+export class UserTokenFileError extends Error {
+  constructor(
+    readonly code:
+      | "token_file_not_ignored"
+      | "token_file_unsafe"
+      | "token_file_has_token"
+      | "token_file_changed"
+      | "token_value_unavailable",
+    readonly keyId?: string,
+  ) {
+    super(
+      {
+        token_file_not_ignored:
+          "Add the selected env file to .gitignore or choose a location outside the repository. No token was created or written.",
+        token_file_unsafe:
+          "Choose a private .env file owned by you. Symlinks, shared files and files larger than 64 KiB are not accepted.",
+        token_file_has_token:
+          "The selected file already contains OHMYHOST_TOKEN. Use that token or choose a new file; existing credentials were preserved.",
+        token_file_changed:
+          "The environment file changed during creation. It was not overwritten. List tokens to inspect the issued key before creating another.",
+        token_value_unavailable:
+          "This token was already issued and its full value cannot be retrieved. Use the previously saved file, or explicitly revoke the listed key before creating a replacement.",
+      }[code] + (keyId ? ` Token ID: ${keyId}.` : ""),
+    );
+  }
+}
+
+/** Prepare before the API call; append only OHMYHOST_TOKEN and never return its value to a chat. */
+export async function prepareUserTokenFile(output: string) {
+  const path = resolve(output);
+  if (!basename(path).startsWith(".env") && !basename(path).endsWith(".env"))
+    throw new UserTokenFileError("token_file_unsafe");
+  let file: FileHandle | undefined;
+  try {
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await requireIgnoredTokenFile(path);
+    const existing = await lstat(path).catch((error: unknown) => {
+      if (error && typeof error === "object" && "code" in error && error.code === "ENOENT")
+        return null;
+      throw error;
+    });
+    if (existing && (!existing.isFile() || existing.isSymbolicLink() || existing.nlink !== 1))
+      throw new UserTokenFileError("token_file_unsafe");
+    file = await open(
+      path,
+      constants.O_RDWR |
+        constants.O_APPEND |
+        (constants.O_NOFOLLOW ?? 0) |
+        (existing ? 0 : constants.O_CREAT | constants.O_EXCL),
+      0o600,
+    );
+    const handle = file;
+    await secureTokenFile(path, handle);
+    const initial = await tokenFileText(handle);
+    if (parseEnv(initial)["OHMYHOST_TOKEN"]) throw new UserTokenFileError("token_file_has_token");
+    const preview = "sk_ohmyho_token_preview_only";
+    if (parseEnv(`${initial}\nOHMYHOST_TOKEN=${preview}\n`)["OHMYHOST_TOKEN"] !== preview)
+      throw new UserTokenFileError("token_file_unsafe");
+    const identity = await handle.stat();
+    return {
+      async save(value: UserApiKeyCreation): Promise<StoredUserApiKey> {
+        const result = parseUserApiKeyCreation(value);
+        if (result.value === null)
+          throw new UserTokenFileError("token_value_unavailable", result.key.id);
+        const current = await lstat(path);
+        if (
+          !current.isFile() ||
+          current.isSymbolicLink() ||
+          current.nlink !== 1 ||
+          current.ino !== identity.ino ||
+          current.dev !== identity.dev ||
+          (await tokenFileText(handle)) !== initial
+        )
+          throw new UserTokenFileError("token_file_changed");
+        await handle.appendFile(`\nOHMYHOST_TOKEN=${result.value}\n`, "utf8");
+        await handle.sync();
+        if (parseEnv(await tokenFileText(handle))["OHMYHOST_TOKEN"] !== result.value)
+          throw new UserTokenFileError("token_file_changed");
+        const saved = await lstat(path);
+        if (
+          !saved.isFile() ||
+          saved.isSymbolicLink() ||
+          saved.ino !== identity.ino ||
+          saved.dev !== identity.dev
+        )
+          throw new UserTokenFileError("token_file_changed", result.key.id);
+        return { request_id: result.request_id, key: result.key, token_file: path };
+      },
+      close: () => handle.close(),
+    };
+  } catch (error) {
+    await file?.close();
+    if (error instanceof UserTokenFileError) throw error;
+    throw new UserTokenFileError("token_file_unsafe");
+  }
+}
+
+async function tokenFileText(file: FileHandle) {
+  const status = await file.stat();
+  if (!status.isFile() || status.nlink !== 1 || status.size > 65_536)
+    throw new UserTokenFileError("token_file_unsafe");
+  const bytes = Buffer.alloc(status.size);
+  const result = await file.read(bytes, 0, bytes.length, 0);
+  if (result.bytesRead !== bytes.length) throw new UserTokenFileError("token_file_changed");
+  return new TextDecoder("utf8", { fatal: true }).decode(bytes);
+}
+
+const windowsAcl = String.raw`
+$ErrorActionPreference = 'Stop'
+$path = $env:OMH_TOKEN_FILE
+$sid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+$current = Get-Acl -LiteralPath $path
+if ($current.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $sid.Value) { throw 'Unexpected owner' }
+$acl = New-Object System.Security.AccessControl.FileSecurity
+$acl.SetOwner($sid)
+$acl.SetAccessRuleProtection($true, $false)
+$acl.AddAccessRule((New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList @($sid, 'FullControl', 'Allow')))
+$system = New-Object -TypeName System.Security.Principal.SecurityIdentifier -ArgumentList 'S-1-5-18'
+$acl.AddAccessRule((New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList @($system, 'FullControl', 'Allow')))
+Set-Acl -LiteralPath $path -AclObject $acl
+$verified = Get-Acl -LiteralPath $path
+$rules = @($verified.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier]))
+if (-not $verified.AreAccessRulesProtected -or $rules.Count -ne 2) { throw 'Unexpected access rules' }
+foreach ($rule in $rules) {
+  if ($rule.IdentityReference.Value -notin @($sid.Value, 'S-1-5-18') -or $rule.AccessControlType -ne 'Allow' -or $rule.FileSystemRights -ne 'FullControl') { throw 'Unexpected access rule' }
+}
+[Console]::Write('secured')
+`;
+
+async function secureTokenFile(path: string, file: FileHandle) {
+  const status = await file.stat();
+  if (process.platform === "win32") {
+    const environment: Record<string, string> = { OMH_TOKEN_FILE: path };
+    for (const name of ["SystemRoot", "WINDIR", "PATH", "TEMP", "TMP", "USERPROFILE"]) {
+      const value = process.env[name];
+      if (value !== undefined) environment[name] = value;
+    }
+    const result = await promisify(execFile)(
+      "powershell.exe",
+      [
+        "-NoProfile",
+        "-NonInteractive",
+        "-EncodedCommand",
+        Buffer.from(windowsAcl, "utf16le").toString("base64"),
+      ],
+      { env: environment, timeout: 10_000, windowsHide: true, maxBuffer: 4096 },
+    );
+    if (result.stdout !== "secured") throw new UserTokenFileError("token_file_unsafe");
+  } else {
+    if (status.uid !== process.getuid?.()) throw new UserTokenFileError("token_file_unsafe");
+    await file.chmod(0o600);
+    if (((await file.stat()).mode & 0o777) !== 0o600)
+      throw new UserTokenFileError("token_file_unsafe");
+  }
+  const observed = await lstat(path);
+  if (observed.isSymbolicLink() || observed.ino !== status.ino || observed.dev !== status.dev)
+    throw new UserTokenFileError("token_file_unsafe");
+}
+
+async function requireIgnoredTokenFile(path: string) {
+  const parent = await realpath(dirname(path));
+  let directory = parent;
+  while (true) {
+    const marker = await lstat(resolve(directory, ".git")).catch((error: unknown) => {
+      if (error && typeof error === "object" && "code" in error && error.code === "ENOENT")
+        return null;
+      throw error;
+    });
+    if (marker !== null) {
+      const environment: Record<string, string> = {};
+      for (const name of ["PATH", "HOME", "USERPROFILE", "SystemRoot", "WINDIR", "TEMP", "TMP"]) {
+        const value = process.env[name];
+        if (value !== undefined) environment[name] = value;
+      }
+      try {
+        await promisify(execFile)(
+          "git",
+          [
+            "-c",
+            "core.fsmonitor=false",
+            "-C",
+            parent,
+            "check-ignore",
+            "--quiet",
+            "--",
+            resolve(parent, basename(path)),
+          ],
+          { env: environment, timeout: 5000, windowsHide: true, maxBuffer: 4096 },
+        );
+      } catch {
+        throw new UserTokenFileError("token_file_not_ignored");
+      }
+      return;
+    }
+    const next = dirname(directory);
+    if (next === directory) return;
+    directory = next;
+  }
+}

package/src/apps/product-cli/workspace.ts

@@ -0,0 +1,92 @@
+import type { TokenRefresher } from "./cli.js";
+import type { CredentialStore, StoredCredential } from "./credential-store.js";
+import type { PublicWorkspace } from "./runtime-contract.js";
+
+/** The credential material a workspace selection needs; absent for a user API token. */
+export interface WorkspaceSession {
+  readonly store: CredentialStore;
+  readonly refresher: TokenRefresher;
+}
+
+/** A user API token carries a fixed scope and can never select another workspace. */
+export class InteractiveSessionRequiredError extends Error {
+  public constructor() {
+    super("Workspace selection requires an interactive login");
+    this.name = "InteractiveSessionRequiredError";
+  }
+}
+
+export type WorkspaceSelection =
+  | { readonly outcome: "selected"; readonly organization: PublicWorkspace }
+  | { readonly outcome: "no_workspace" }
+  | { readonly outcome: "choice_required"; readonly organizations: readonly PublicWorkspace[] }
+  | { readonly outcome: "not_a_member"; readonly organizations: readonly PublicWorkspace[] };
+
+/**
+ * Decide which workspace a login or creation should select. A caller that named one gets exactly
+ * that one or nothing; an unnamed choice is only made when the answer cannot be wrong.
+ */
+export const chooseWorkspace = (
+  organizations: readonly PublicWorkspace[],
+  requested: string | undefined,
+): WorkspaceSelection => {
+  if (requested !== undefined) {
+    const match = organizations.find((organization) => organization.id === requested);
+    return match === undefined
+      ? { outcome: "not_a_member", organizations }
+      : { outcome: "selected", organization: match };
+  }
+  if (organizations.length === 0) return { outcome: "no_workspace" };
+  const only = organizations[0];
+  if (organizations.length === 1 && only !== undefined)
+    return { outcome: "selected", organization: only };
+  return { outcome: "choice_required", organizations };
+};
+
+/**
+ * Put the chosen workspace into the stored credential. The organization lives in the access token,
+ * so selecting means asking the provider for a token scoped to it and keeping both identifiers.
+ */
+export const selectWorkspace = async (
+  session: WorkspaceSession,
+  organization: PublicWorkspace,
+  signal: AbortSignal,
+): Promise<void> => {
+  const stored = await session.store.read();
+  if (stored === undefined) throw new InteractiveSessionRequiredError();
+  const refreshed = await session.refresher.refresh(
+    stored.refreshToken,
+    signal,
+    organization.workos_id,
+  );
+  await session.store.replace({
+    ...refreshed,
+    workosOrganizationId: organization.workos_id,
+    organizationId: organization.id,
+  });
+};
+
+/** The workspace the stored credential is scoped to, or null while none was selected. */
+export const selectedWorkspaceId = async (session: WorkspaceSession): Promise<string | null> =>
+  (await session.store.read())?.organizationId ?? null;
+
+/**
+ * The workspace fields of a credential, present only once one has been selected. A refresh returns
+ * a bare credential, so carrying these forward is what keeps the selection alive.
+ */
+export const workspaceOf = (
+  credential: StoredCredential,
+): { workosOrganizationId?: string; organizationId?: string } => ({
+  ...(credential.workosOrganizationId === undefined
+    ? {}
+    : { workosOrganizationId: credential.workosOrganizationId }),
+  ...(credential.organizationId === undefined ? {} : { organizationId: credential.organizationId }),
+});
+
+/** The customer-visible projection; the provider identifier stays inside the client. */
+export const publicWorkspace = (
+  organization: PublicWorkspace,
+): { readonly id: string; readonly name: string } => ({
+  id: organization.id,
+  name: organization.name,
+});

package/src/packages/contracts/application-root.ts

@@ -0,0 +1,80 @@
+declare const applicationRootBrand: unique symbol;
+export type ApplicationRoot = string & {
+  readonly [applicationRootBrand]: "ApplicationRoot";
+};
+
+export const APPLICATION_ROOT_PATTERN =
+  /^(?:\.|[A-Za-z0-9][A-Za-z0-9._-]*(?:\/[A-Za-z0-9][A-Za-z0-9._-]*)*)$/u;
+export const APPLICATION_ROOT_MAX_BYTES = 64;
+export const APPLICATION_ROOT_MAX_SEGMENTS = 8;
+export const APPLICATION_ROOT_MAX_SEGMENT_BYTES = 63;
+
+export const APPLICATION_ROOT_CONFORMANCE_CORPUS = Object.freeze({
+  accepted: Object.freeze([
+    Object.freeze({ name: "repository root", value: "." }),
+    Object.freeze({ name: "single segment", value: "site" }),
+    Object.freeze({ name: "portable segment punctuation", value: "apps/web.v2_test-prod" }),
+    Object.freeze({ name: "maximum segment bytes", value: "a".repeat(63) }),
+    Object.freeze({
+      name: "maximum total bytes",
+      value: `${"a".repeat(31)}/${"b".repeat(32)}`,
+    }),
+    Object.freeze({ name: "maximum segment count", value: "a/b/c/d/e/f/g/h" }),
+  ]),
+  rejected: Object.freeze([
+    Object.freeze({ name: "empty string", value: "" }),
+    Object.freeze({ name: "absolute path", value: "/site" }),
+    Object.freeze({ name: "parent traversal", value: "../site" }),
+    Object.freeze({ name: "embedded traversal", value: "apps/../site" }),
+    Object.freeze({ name: "leading dot segment", value: "./site" }),
+    Object.freeze({ name: "trailing separator", value: "site/" }),
+    Object.freeze({ name: "repeated separator", value: "apps//site" }),
+    Object.freeze({ name: "backslash", value: "apps\\site" }),
+    Object.freeze({ name: "colon syntax", value: "C:site" }),
+    Object.freeze({ name: "leading whitespace", value: " site" }),
+    Object.freeze({ name: "trailing whitespace", value: "site " }),
+    Object.freeze({ name: "control character", value: "site\nweb" }),
+    Object.freeze({ name: "unicode", value: "café" }),
+    Object.freeze({ name: "percent ambiguity", value: "site%2fweb" }),
+    Object.freeze({ name: "hidden segment", value: ".site" }),
+    Object.freeze({ name: "nine segments", value: "a/b/c/d/e/f/g/h/i" }),
+    Object.freeze({ name: "segment over 63 bytes", value: "a".repeat(64) }),
+    Object.freeze({
+      name: "path over 64 bytes",
+      value: `${"a".repeat(32)}/${"b".repeat(32)}`,
+    }),
+    Object.freeze({ name: "non-string", value: 1 }),
+  ]),
+  ustarEnvelope: Object.freeze([
+    Object.freeze({
+      name: "maximum accepted application root",
+      repositoryNameBytes: 100,
+      separatorBytes: 3,
+      commitShaBytes: 40,
+      applicationRootBytes: 64,
+      inspectionLeafBytes: 24,
+      archivePathBytes: 231,
+      ustarPathEnvelopeBytes: 255,
+      fitsWithoutPax: true,
+    }),
+  ]),
+});
+
+export function normalizeApplicationRoot(value: unknown = "."): ApplicationRoot {
+  if (typeof value !== "string" || !APPLICATION_ROOT_PATTERN.test(value)) {
+    throw new TypeError("Application root is invalid");
+  }
+  const encoder = new TextEncoder();
+  const encoded = encoder.encode(value);
+  const segments = value === "." ? [] : value.split("/");
+  if (
+    encoded.byteLength > APPLICATION_ROOT_MAX_BYTES ||
+    segments.length > APPLICATION_ROOT_MAX_SEGMENTS ||
+    segments.some(
+      (segment) => encoder.encode(segment).byteLength > APPLICATION_ROOT_MAX_SEGMENT_BYTES,
+    )
+  ) {
+    throw new TypeError("Application root is invalid");
+  }
+  return value as ApplicationRoot;
+}

package/src/packages/contracts/billing.ts

@@ -0,0 +1,172 @@
+export type BillingTaxIssueCode =
+  | "billing_tax_location_required"
+  | "billing_tax_calculation_failed"
+  | "billing_tax_configuration_required";
+export interface BillingTaxIssue {
+  code: BillingTaxIssueCode;
+  invoice_id: string;
+  observed_at: string;
+  required_action: "open_billing_portal" | "contact_support";
+}
+
+export interface BillingCheckoutView {
+  organization_id: string;
+  checkout_id: string;
+  offer: "topup" | "paid";
+  state: "open" | "complete" | "expired";
+  payment_confirmed: boolean;
+  url: string | null;
+  expires_at: string;
+  packs: number;
+  credited_micros: string;
+  revoked_micros: string;
+  paid_until: string | null;
+  required_action: "none" | "complete_checkout" | "open_billing_portal" | "contact_support";
+  billing_issue: BillingTaxIssue | null;
+}
+export interface BillingPortalView {
+  organization_id: string;
+  url: string;
+  created_at: string;
+}
+export function assertBillingTaxIssue(value: unknown): asserts value is BillingTaxIssue | null {
+  if (value === null) return;
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("billing_response_invalid");
+  const v = value as Record<string, unknown>;
+  if (
+    Object.keys(v).sort().join(",") !== "code,invoice_id,observed_at,required_action" ||
+    ![
+      "billing_tax_location_required",
+      "billing_tax_calculation_failed",
+      "billing_tax_configuration_required",
+    ].includes(String(v["code"])) ||
+    typeof v["invoice_id"] !== "string" ||
+    !/^in_[A-Za-z0-9_]{1,253}$/u.test(v["invoice_id"]) ||
+    !timestamp(v["observed_at"]) ||
+    v["required_action"] !==
+      (v["code"] === "billing_tax_location_required" ? "open_billing_portal" : "contact_support")
+  )
+    throw new Error("billing_response_invalid");
+}
+const ulid = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u;
+const timestamp = (v: unknown): v is string =>
+  typeof v === "string" && Number.isFinite(Date.parse(v)) && new Date(v).toISOString() === v;
+function stripeUrl(value: unknown, host: string): value is string {
+  if (typeof value !== "string" || value.length > 8192) return false;
+  try {
+    const u = new URL(value);
+    return u.protocol === "https:" && u.hostname === host && !u.username && !u.password && !u.port;
+  } catch {
+    return false;
+  }
+}
+export function assertBillingCheckout(value: unknown): asserts value is BillingCheckoutView {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("billing_response_invalid");
+  const v = value as Record<string, unknown>;
+  if (
+    Object.keys(v).sort().join(",") !==
+      "billing_issue,checkout_id,credited_micros,expires_at,offer,organization_id,packs,paid_until,payment_confirmed,required_action,revoked_micros,state,url" ||
+    typeof v["organization_id"] !== "string" ||
+    !ulid.test(v["organization_id"]) ||
+    typeof v["checkout_id"] !== "string" ||
+    !ulid.test(v["checkout_id"]) ||
+    typeof v["offer"] !== "string" ||
+    !["topup", "paid"].includes(v["offer"]) ||
+    typeof v["state"] !== "string" ||
+    !["open", "complete", "expired"].includes(v["state"]) ||
+    typeof v["payment_confirmed"] !== "boolean" ||
+    typeof v["required_action"] !== "string" ||
+    !["none", "complete_checkout", "open_billing_portal", "contact_support"].includes(
+      v["required_action"],
+    ) ||
+    (v["url"] !== null && !stripeUrl(v["url"], "checkout.stripe.com")) ||
+    !timestamp(v["expires_at"]) ||
+    (v["paid_until"] !== null && !timestamp(v["paid_until"])) ||
+    !Number.isInteger(v["packs"]) ||
+    Number(v["packs"]) < 1 ||
+    Number(v["packs"]) > 100 ||
+    (v["offer"] === "paid" && v["packs"] !== 1) ||
+    ![v["credited_micros"], v["revoked_micros"]].every(
+      (x) => typeof x === "string" && /^(0|[1-9][0-9]{0,18})$/u.test(x),
+    )
+  )
+    throw new Error("billing_response_invalid");
+  assertBillingTaxIssue(v["billing_issue"]);
+}
+export function assertBillingPortal(value: unknown): asserts value is BillingPortalView {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("billing_response_invalid");
+  const v = value as Record<string, unknown>;
+  if (
+    Object.keys(v).sort().join(",") !== "created_at,organization_id,url" ||
+    typeof v["organization_id"] !== "string" ||
+    !ulid.test(v["organization_id"]) ||
+    !timestamp(v["created_at"]) ||
+    !stripeUrl(v["url"], "billing.stripe.com")
+  )
+    throw new Error("billing_response_invalid");
+}
+
+export interface RechargeView {
+  organization_id: string;
+  portal_available: boolean;
+  enabled: boolean;
+  revision: number;
+  status:
+    | "off"
+    | "setup_required"
+    | "on"
+    | "payment_required"
+    | "monthly_limit"
+    | "needs_reconciliation"
+    | "tax_required";
+  monthly_limit_minor: number;
+  spent_minor: number;
+  currency: "usd";
+  amount_minor: 900;
+  credits: 1000;
+  threshold_credits: 100;
+  setup_url: string | null;
+  invoice_url: string | null;
+  billing_issue: BillingTaxIssue | null;
+}
+export function assertRecharge(value: unknown): asserts value is RechargeView {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("billing_response_invalid");
+  const v = value as Record<string, unknown>;
+  if (
+    Object.keys(v).sort().join(",") !==
+      "amount_minor,billing_issue,credits,currency,enabled,invoice_url,monthly_limit_minor,organization_id,portal_available,revision,setup_url,spent_minor,status,threshold_credits" ||
+    typeof v["organization_id"] !== "string" ||
+    !ulid.test(v["organization_id"]) ||
+    typeof v["portal_available"] !== "boolean" ||
+    typeof v["enabled"] !== "boolean" ||
+    !Number.isSafeInteger(v["revision"]) ||
+    Number(v["revision"]) < 0 ||
+    !Number.isSafeInteger(v["monthly_limit_minor"]) ||
+    Number(v["monthly_limit_minor"]) < 1000 ||
+    Number(v["monthly_limit_minor"]) > 100000 ||
+    !Number.isSafeInteger(v["spent_minor"]) ||
+    Number(v["spent_minor"]) < 0 ||
+    v["currency"] !== "usd" ||
+    v["amount_minor"] !== 900 ||
+    v["credits"] !== 1000 ||
+    v["threshold_credits"] !== 100 ||
+    typeof v["status"] !== "string" ||
+    ![
+      "off",
+      "setup_required",
+      "on",
+      "payment_required",
+      "monthly_limit",
+      "needs_reconciliation",
+      "tax_required",
+    ].includes(v["status"]) ||
+    (v["setup_url"] !== null && !stripeUrl(v["setup_url"], "checkout.stripe.com")) ||
+    (v["invoice_url"] !== null && !stripeUrl(v["invoice_url"], "invoice.stripe.com"))
+  )
+    throw new Error("billing_response_invalid");
+  assertBillingTaxIssue(v["billing_issue"]);
+}