@amerged/ohmyhost-mcp 0.1.18 → 0.1.20

package/src/apps/product-cli/command.ts

@@ -1,5 +1,7 @@
 import type { ManagedMailCommand } from "@ohmyhost/sdk-ts";
 import { USER_API_KEY_ID } from "@ohmyhost/contracts/user-api-keys";
+import { WORKOS_USER_API_KEY_PATTERN } from "@ohmyhost/workos-auth-contracts/user-api-keys";
+import { isProfileName, isProfileUserId } from "./profile-store.js";
 export type ProductCliCommand =
   | {
       readonly kind: "github-connect";
@@ -182,8 +184,11 @@ export type ProductCliCommand =
   | {
       readonly kind: "login";
       readonly organizationId?: string;
+      /** The user the browser must sign in as; a different account stores nothing. */
+      readonly userId?: string;
       readonly credentialStore: "native";
     }
+  | { readonly kind: "profile-list" }
   | {
       readonly kind: "logout";
       readonly revoke: boolean;
@@ -421,6 +426,10 @@ export type ProductCliCommand =
       readonly idempotencyKey: string;
       readonly stdin: true;
       readonly wait: boolean;
+      /** Handed over from an OHMYHOST_TOKEN process: only a key of this account may run it. */
+      readonly environmentToken?: HandedAccount;
+      /** Handed over for a saved login: the login that runs it must belong to this account. */
+      readonly profileAccount?: HandedAccount;
       readonly credentialStore: "native";
     }
   | {
@@ -497,6 +506,25 @@ export type ProductCliCommand =
       readonly credentialStore: "native";
     };
 
+/**
+ * Remove the global login selector from argv. Every authenticated command accepts it; `login` uses
+ * the same flag to name the login it adds. The value is an alias, never a credential.
+ */
+export const extractProfileName = (
+  argv: readonly string[],
+): { readonly argv: readonly string[]; readonly profileName?: string } => {
+  const index = argv.indexOf("--profile-name");
+  if (index < 0) return { argv };
+  const value = argv[index + 1];
+  if (
+    value === undefined ||
+    !isProfileName(value) ||
+    argv.indexOf("--profile-name", index + 1) >= 0
+  )
+    throw new InvalidCommandError();
+  return { argv: [...argv.slice(0, index), ...argv.slice(index + 2)], profileName: value };
+};
+
 export class InvalidCommandError extends Error {
   public constructor() {
     super("The command arguments are invalid.");
@@ -528,6 +556,7 @@ export type RecognizedCommandLabel =
   | "init"
   | "login"
   | "logout"
+  | "profile list"
   | "operation get"
   | "operation reconcile"
   | "token create"
@@ -598,6 +627,10 @@ export const recognizedCommandLabel = (argv: readonly string[]): RecognizedComma
   if (values.includes("--version")) return "version";
   while (values.length > 0) {
     const value = values.shift();
+    if (value === "--profile-name") {
+      values.shift();
+      continue;
+    }
     if (
       value === "--json" ||
       value === "--dry-run" ||
@@ -618,6 +651,7 @@ export const recognizedCommandLabel = (argv: readonly string[]): RecognizedComma
       value === "logout"
     )
       return value;
+    if (value === "profile" && values[0] === "list") return "profile list";
     if (value === "github" && values[0] === "connect") return "github connect";
     if (value === "github" && values[0] === "status") return "github status";
     if (value === "operation" && values[0] === "get") return "operation get";
@@ -788,16 +822,32 @@ export const parseProductCliCommand = (argv: readonly string[]): ProductCliComma
   }
   if (dryRun) throw new InvalidCommandError();
   if (first === "login" && !revoke && !yes && !wait && !follow && !stdin) {
-    const options = parseOptionalOptions(values, ["--organization"]);
+    const options = parseOptionalOptions(values, ["--organization", "--user"]);
     const organizationId = options["--organization"];
-    if (organizationId !== undefined && !ORGANIZATION_ULID.test(organizationId))
+    const userId = options["--user"];
+    if (
+      (organizationId !== undefined && !ORGANIZATION_ULID.test(organizationId)) ||
+      (userId !== undefined && !isProfileUserId(userId))
+    )
       throw new InvalidCommandError();
     return {
       kind: "login",
       ...(organizationId === undefined ? {} : { organizationId }),
+      ...(userId === undefined ? {} : { userId }),
       credentialStore,
     };
   }
+  if (
+    first === "profile" &&
+    values.length === 1 &&
+    values[0] === "list" &&
+    !revoke &&
+    !yes &&
+    !wait &&
+    !follow &&
+    !stdin
+  )
+    return { kind: "profile-list" };
   if (first === "logout") {
     if (!yes && !wait && !follow && !stdin && values.length === 0)
       return { kind: "logout", revoke, credentialStore };
@@ -1781,15 +1831,44 @@ export const parseProductCliCommand = (argv: readonly string[]): ProductCliComma
     values.shift();
     const name = values.shift();
     if (!isUserSecretName(name)) throw new InvalidCommandError();
-    const options = parseOptions(values, ["--project", "--environment", "--idempotency-key"]);
+    const options = parseOptionalOptions(values, [
+      "--project",
+      "--environment",
+      "--idempotency-key",
+      "--token-user",
+      "--token-organization",
+      "--profile-user",
+      "--profile-organization",
+    ]);
+    const projectId = options["--project"];
+    const environmentId = options["--environment"];
+    const idempotencyKey = options["--idempotency-key"];
+    const environmentToken = handedAccount(
+      options["--token-user"],
+      options["--token-organization"],
+    );
+    const profileAccount = handedAccount(
+      options["--profile-user"],
+      options["--profile-organization"],
+    );
+    // A key form and a saved-login form contradict each other; neither wins.
+    if (
+      projectId === undefined ||
+      environmentId === undefined ||
+      idempotencyKey === undefined ||
+      (environmentToken !== undefined && profileAccount !== undefined)
+    )
+      throw new InvalidCommandError();
     return {
       kind: "secret-set",
-      projectId: options["--project"],
-      environmentId: options["--environment"],
+      projectId,
+      environmentId,
       name,
-      idempotencyKey: options["--idempotency-key"],
+      idempotencyKey,
       stdin,
       wait,
+      ...(environmentToken === undefined ? {} : { environmentToken }),
+      ...(profileAccount === undefined ? {} : { profileAccount }),
       credentialStore,
     };
   }
@@ -2034,6 +2113,32 @@ const accessTtlSeconds = (value: string | undefined): number => {
 /** A platform organization identifier as the API returns it. */
 const ORGANIZATION_ULID = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u;
 
+/** The account a command handed to a terminal must run as; never a credential. */
+export interface HandedAccount {
+  readonly userId: string;
+  readonly organizationId: string;
+}
+
+/**
+ * A user and an organization named together, or neither. A pasted key is refused here, before any
+ * message could repeat it.
+ */
+const handedAccount = (
+  userId: string | undefined,
+  organizationId: string | undefined,
+): HandedAccount | undefined => {
+  if (userId === undefined && organizationId === undefined) return undefined;
+  if (
+    userId === undefined ||
+    organizationId === undefined ||
+    !isProfileUserId(userId) ||
+    WORKOS_USER_API_KEY_PATTERN.test(userId) ||
+    !ORGANIZATION_ULID.test(organizationId)
+  )
+    throw new InvalidCommandError();
+  return { userId, organizationId };
+};
+
 const isValue = (value: string | undefined): value is string =>
   value !== undefined && value.length > 0 && !value.startsWith("--");